Closed c4-bot-3 closed 6 months ago
Removing liquidity should decrease the weight. Leaving for sponsor review.
0xRobocop marked the issue as sufficient quality report
0xRobocop marked the issue as primary issue
enthusiastmartin (sponsor) disputed
This report is not valid.
by removing liquidity, the weight of asset has decreased. It does not matter if decreased below the weight cap or it is still above it.
As mentioned, the weight will always decrease on withdrawals. If it was already above the cap before for some reason, adding this check would actually be harmful (in that case, removal of liquidity should be encouraged).
OpenCoreCH marked the issue as unsatisfactory: Invalid
Lines of code
https://github.com/code-423n4/2024-02-hydradx/blob/603187123a20e0cb8a7ea85c6a6d718429caad8d/HydraDX-node/pallets/omnipool/src/lib.rs#L773-L782
Vulnerability details
Impact
Omnipool's
asset_weight_cap
can be bypassed, resulting in an unhealthy state of the poolProof of Concept
In Omnipool,
asset_weight_cap
is a safe-guard in place as liquidity restriction, to ensure thatany token cannot make up a greater proportion of the Omnipool than initially defined by the cap
. See doc.The problem is
asset_weight_cap
is only applied inadd_liquidity()
flow and can be easily bypassed by users callingremove_liquidity()
.(1) Success case:
add_liquidity()
Inadd_liquidity()
, after calculating the new asset state,hub_reserve_ratio
is calculated and used to compare theasset_weight_cap
. This ensures if too much asset is added, tx will revert withError::<T>::AssetWeightCapExceeded
.(https://github.com/code-423n4/2024-02-hydradx/blob/603187123a20e0cb8a7ea85c6a6d718429caad8d/HydraDX-node/pallets/omnipool/src/lib.rs#L636-L638)
(2)Bypass case:
remove_liquidity()
But inremove_liquidity()
, a newhub_reserve_ratio
is not calculated and is not used to compare withasset_weight_cap
. The only check isprice barrier
which only verifies the before-change ratio, and will not be used to verify after-change.(https://github.com/code-423n4/2024-02-hydradx/blob/603187123a20e0cb8a7ea85c6a6d718429caad8d/HydraDX-node/pallets/omnipool/src/lib.rs#L773-L782)
Tools Used
Manual
Recommended Mitigation Steps
Add
asset_weight_cap
checks in remove liquidity as well.Assessed type
Invalid Validation