Closed c4-bot-10 closed 5 months ago
0xRobocop marked the issue as duplicate of #158
OpenCoreCH marked the issue as satisfactory
Hi @OpenCoreCH, thanks for the review. I think this issue is not duplicated to #93. #93 is about no minimum_amount_out
for the liquidity removal function. But this issue is about the problem of setting the safe withdraw mode: set_asset_tradable_state
does not ensure the slot price is not far from the Oracle price so it can be front-run by attackers. Later when the user calls the removal function, there will be no ensure_price
call because it's in safe mode, and the user will suffer from max 100% fee loss. In contrast, #93 didn't mention the safe withdrawal attack mechanism and the impact is much smaller (~1%).
OpenCoreCH marked the issue as not a duplicate
OpenCoreCH marked the issue as duplicate of #22
Lines of code
https://github.com/code-423n4/2024-02-hydradx/blob/main/HydraDX-node/pallets/omnipool/src/lib.rs#L745
Vulnerability details
Impact
Users can lose all the withdrawn assets as fees when the asset is in safe withdraw mode.
Proof of Concept
In
remove_liquidity
, we will skip the spot/oracle price check if it's a safe mode withdraw (i.e. sell and buy are disabled).To prevent liquidity attacks, we apply a fee (max 100%) on the withdrawal action, which depends on the spot/oracle price diff.
It seems we assume if the asset is in safe mode, spot/oracle price diff should be minimal since the trade is disabled and other operations don't change the price.
However, in
set_asset_tradable_state
which can set an asset to the safe mode, we don't check if the spot/oracle diff is big (T::PriceBarrier::ensure_price
), which can lead to:set_asset_tradable_state
.ensure_price
is not triggered this time and Alice will suffer from a big fee.Tools Used
Manual Review.
Recommended Mitigation Steps
Call
ensure_price
inset_asset_tradable_state
when we set an asset to the safe mode.Assessed type
Context