Closed c4-bot-1 closed 4 months ago
Picodes marked the issue as primary issue
All tokenId operations are supposed to be on empty slots -- there is a clearLeg function that allows a tokenId leg to be cleared if needed. The tokenId is just a 256-bit number and does not in itself carry significant information about the protocol's current state. In your example, you are minting two different tokenIds (which are accounted as two entirely separate positions) that each have one leg/long, and then querying one of them (which should indeed have one leg). Don't see an issue here.
Picodes marked the issue as unsatisfactory: Invalid
Lines of code
https://github.com/code-423n4/2024-04-panoptic/blob/833312ebd600665b577fbd9c03ffa0daf250ed24/contracts/PanopticPool.sol#L547-L561
Vulnerability details
Summary
A user can knowingly or unknowingly override a minted position leg index with a different leg containing a different configuration.
Detailed Description
There are checks actually put in place by the protocol to safe guard against this, but it some how still break through by allowing users to knowingly or unknowingly override a minted position leg index with a different leg containing a different configurations such as the options type, assets and so on. This
Example;
Bob mints a position by calling the
mintOptions
function after configuring the legs in thepositionIdList
array by passing in the required values and starting at an index of 0 tokenId leg.AFter a while, bob can either knowingly mint another position still in the
positionIdList
by configuring a tokenId with a leg and specifying an index of 0 instead of 1 which is meant to be the next legIndex.This overrides the existing index of 1 and clears out the previous index of 0 leading to a deletion of that particular position.
Impact:
This is a break in core contracts logic as the protocol was meant to be resilient against such actions.
Proof of Code
After running the following test, check the
tokenId.countLegs()
and it will be 1 as opposed to actual value of 2Run the following test in the projects test suit using the same setup to validate the bug
Tool used:
Manual Review
Recommended Mitigation:
The protocol should make provision for more internal checks in the configuration of tokenIds
Assessed type
Error