Lines of code

Vulnerability details

Vulnerability

The original vulnerability allowed all orders to potentially be hijacked, enabling malicious actors to lock rental assets indefinitely by tipping with a malicious ERC20 token. The root cause of this vulnerability was the lack of validation for ERC20 tokens used in tipping, which could be exploited to introduce tokens that disrupt the rental process.

Mitigation

All offer and consideration items are now checked against a whitelist for all order types. This approach ensures that only pre-approved ERC20 tokens can be used in transactions, thereby preventing the use of malicious tokens. While it is still possible to tip with ERC20 tokens, these tokens must be whitelisted, which prevents malicious tokens from being used.

Suggestion

While the whitelist approach is effective, it requires ongoing monitoring to ensure that all tokens on the list remain safe to interact with. Some tokens may be deployed behind a proxy and could be upgraded with additional problematic functionality.

Conclusion

The vulnerability was effectively mitigated by implementing a whitelist check for all ERC20 tokens involved in orders.

Assessed type

Context

code-423n4 / 2024-02-renft-mitigation-findings

H-01 MitigationConfirmed #41