Open c4-bot-8 opened 4 months ago
JustDravee marked the issue as duplicate of #409
JustDravee marked the issue as sufficient quality report
koolexcrypto marked the issue as unsatisfactory: Invalid
koolexcrypto marked the issue as not a duplicate
koolexcrypto removed the grade
koolexcrypto marked the issue as duplicate of #74
koolexcrypto marked the issue as duplicate of #992
koolexcrypto marked the issue as satisfactory
koolexcrypto changed the severity to 2 (Med Risk)
koolexcrypto marked the issue as not a duplicate
koolexcrypto marked the issue as primary issue
koolexcrypto marked the issue as selected for report
Lines of code
https://github.com/code-423n4/2024-04-dyad/blob/main/src/core/VaultManagerV2.sol#L172-L181
Vulnerability details
Description:
VaultManagerV2.sol
has a functionburnDyad
that allows a DNft owner to burn his minted DYAD tokens.However, the function does not check if the DNft id that is passed to it and the
isValidDNft
modifier belongs tomsg.sender
, allowing any DNft owner to burn any other DNft owner minted DYAD by calling theburnDyad
function with the other user's DNft id.Impact:
A user can prevent an open position from being liquidated by calling
VaultManagerV2::burnDyad
to burn his own DYAD balance, while retaining his DYAD debt, effectively creating bad debt that cannot be liquidated nor redeemed.Moreover, by specifying a different DNft id from their own when calling
VaultManagerV2::burnDyad
, the user can clear DYAD debt from another position while retaining the DYAD balance associated with it, effectively tricking the protocol in allowing him to mint more DYAD as the position no longer has DYAD debt.Proof of Concept:
VaultManagerHelper.t.sol
VaultManager.t.sol
VaultManagerV2.sol
(notVaultManager.sol
) and run with:VaultManagerHelper.t.sol
VaultManager.t.sol
Tools Used:
Manual Review
Recommended Mitigation:
Add
isDNftOwner
modifier toVaultManagerV2.sol::burnDyad
to check if the passed DNft id belongs tomsg.sender
, preventing the function caller from being able to burn another user's minted DYAD.Assessed type
DoS