hats-finance / Intuition-0x538dbadc50cc87b281cd655f1edbc6ebda02a66a

The smart contracts of the Intuition protocol v1.
https://intuition.systems
Other
0 stars 1 forks source link

Users can DOS `depositTriple` for tother users #36

Open hats-bug-reporter[bot] opened 1 week ago

hats-bug-reporter[bot] commented 1 week ago

Github username: @0x3b33 Twitter username: -- Submission hash (on-chain): 0xdca2cb75cae14bac4ac7744b79281929eef1c25c2faec691bc6cff97e630efdf Severity: medium

Description: Description\ Triple vaults have two vaults - a normal vault with a normal ID and a counter vault with an ID set to uint256.max - normal ID.

When making a deposit with depositTriple, we check if a user has deposited into the counter vault using _hasCounterStake. If the user has, the transaction is reverted, as they can only have shares in one of the vaults at a time.

However, another user can front-run a deposit and deposit the minimum amount of assets for the first user, preventing them from depositing into their desired triple vault, essentially causing a DOS.

Attack Scenario

  1. Alice sends a transaction to deposit into a triple vault.
  2. Bob sees that transaction, front-runs it, and deposits for her into the opposite vault with the minimum deposit amount.
  3. Alice's transaction reverts because she now has some balance in the opposite vault.

Recommendations The best solution for this issue is not clear. A crude recommendations can be to make deposits only for msg.sender.

mihailo-maksa commented 4 days ago

Duplicate of issue #8.