Closed c4-bot-1 closed 6 months ago
Protocol has POL for that pool. Leaving for sponsor review since I am not sure.
0xRobocop marked the issue as primary issue
0xRobocop marked the issue as sufficient quality report
enthusiastmartin (sponsor) disputed
Works as intented. There is no reason to restrict it by the min/max ratio.
No restriction for the subpool is intended, warden does not show why the restriction would be necessary.
OpenCoreCH marked the issue as unsatisfactory: Insufficient proof
Lines of code
https://github.com/code-423n4/2024-02-hydradx/blob/main/HydraDX-node/pallets/omnipool/src/lib.rs#L1637
Vulnerability details
Impact
The HDX/LRNA pool is not protected by the MaxInRatio and circuit breaker through
update_hdx_subpool_hub_asset
, making this pool vulnerable to attacks when the liquidity is low.Proof of Concept
When users buy/sell assets, we make sure the input assets are not beyond the
MaxInRatio
, and call the circuit breaker in case of exceeding trading volume.When users buy/sell assets, there is a protocol fee being charged and added to the HDX/LRNA pool in
update_hdx_subpool_hub_asset
.As we can see, there is no protection on the input size and trading volume for the HDX pool, so it's vulnerable to attacks when the liquidity is low (the attacker can keep triggering the protocol fee charges to quickly increase the hdx price).
Tools Used
Manual Review.
Recommended Mitigation Steps
In
update_hdx_subpool_hub_asset
, we should add:And call
T::OmnipoolHooks::on_liquidity_changed()
for the HDX assets.Assessed type
Context