c4-bot-1 commented 5 months ago

Lines of code

https://github.com/code-423n4/2024-05-canto/blob/d1d51b2293d4689f467b8b1c82bba84f8f7ea008/canto-main/x/coinswap/keeper/keeper.go#L168

Vulnerability details

Impact

DoS attack makes functions in coinswap unusable

Proof of Concept

In general, if anyone is running in the array and an attacker adds a large number of elements to the array, it will consume a large amount of gas while traversing the array, and the related function will fail to execute due to insufficient gas.

The AddLiquidity RemoveLiquidity calculateWithExactInput in coinswap will pass k.GetPoolBalances The banlance of all tokens in the pool.

k.GetPoolBalances -> k.bk.GetAllBalances

Let's take a look at bk.GetAllBalances, which iterate through the balance(IterateAccountBalances) of all tokens in the pool and then add them to an array and sort them.

https://github.com/cosmos/cosmos-sdk/blob/d21620d1280538ddb1129af4979d62878850ff99/x/bank/keeper/view.go#L99

func (k BaseViewKeeper) GetAllBalances(ctx context.Context, addr sdk.AccAddress) sdk.Coins {
    balances := sdk.NewCoins()
    k.IterateAccountBalances(ctx, addr, func(balance sdk.Coin) bool {
        balances = balances.Add(balance)
        return false
    })

    return balances.Sort()
}

sdk.NewCoins() returns Coins, Coins is an array: https://github.com/cosmos/cosmos-sdk/blob/d21620d1280538ddb1129af4979d62878850ff99/types/coin.go#L191

When AddLiquidity is in the coinswap module, k.CreatePool is called to create a pool if the pool does not exist,

    pool = k.CreatePool(ctx, msg.MaxToken.Denom)

An attacker can create a large number of tokens with AddLiquidity (or perhaps in other ways) and then send the balance to the target pool to be attacked.

When other users call functions in coinswap, the execution fails because the number of balances arrays returned by GetPoolBalances is too large, consumes too much gas, or the transaction execution failed because of insufficient gas.

Tools Used

vscode, manual

Recommended Mitigation Steps

Do not usebk.GetAllBalances to obtain the balances of all tokens, but only the balances of one token in the pool at a time.

Assessed type

DoS

c4-judge commented 5 months ago

3docSec changed the severity to 2 (Med Risk)