Open c4-bot-5 opened 7 months ago
Picodes marked the issue as primary issue
othernet-global (sponsor) disputed
othernet-global (sponsor) acknowledged
othernet-global (sponsor) confirmed
Downgrading to QA. This is a known problem for "maintenance" functions such as triggering updates or liquidations that distribute rewards to the callers. Even if we add a slippage check the caller can still lose gas. Essentially the caller has a piece of information - calling this function is profitable - that anyone can use so they should never use a public rpc or they will for sure be frontrun.
I consider such keepers to be advanced players and are aware of MEV and will use private mempools or private RPCs to not be frontrun.
Picodes changed the severity to QA (Quality Assurance)
Lines of code
https://github.com/code-423n4/2024-01-salty/blob/53516c2cdfdfacb662cdea6417c52f23c94d5b5b/src/Upkeep.sol#L244 https://github.com/code-423n4/2024-01-salty/blob/53516c2cdfdfacb662cdea6417c52f23c94d5b5b/src/Upkeep.sol#L112
Vulnerability details
Impact
The Upkeep::performUpkeep function serves to update various aspects of the system. The system rewards the
caller
with 5% of the arbitrage profits in wETH, as demonstrated in the code snippet below:Afterward, the remaining
wETH
is distributed, with 5% going to USDS/DAI Protocol Owned Liquidity, 20% to SALT/USDS Protocol Owned Liquidity, and the remainder sent toSaltRewards
. The issue lies in the fact that thecaller
has no control over whether they receive rewards or not. If another transaction front-runs and captures all the rewards, thecaller
will receive nothing, having only expended gas. This scenario is quite likely, given that theUpkeep::performUpkeep
function can be called by anyone, enabling multiple transactions to be in the mempool, with only the first transaction in the block receiving the rewards.Proof of Concept
A test was conducted to illustrate how
Bob's
transaction is executed first in the same block, enabling Bob to claim the rewards. Subsequently,Alice's
transaction is executed, but she receives no rewards:Tools used
Manual review
Recommended Mitigation Steps
Allow the
caller
to specify the expected minimum amount of rewards. This would ensure that thecaller
is guaranteed a reward otherwise the transaction will be reverted and thecaller
won't expend on gas.Assessed type
Context