search

sherlock-audit / 2023-05-perennial-judging

12 stars 9 forks source link

levi - Griefing attack against users in `BalancedVault` #177

Closed sherlock-admin closed 1 year ago

sherlock-admin commented 1 year ago

levi

medium

Griefing attack against users in BalancedVault

Summary

Griefing attack against users in BalancedVault

Vulnerability Detail

Anyone can call BalancedVault::syncAccount on behalf of another user

    function syncAccount(address account) public {
        (EpochContext memory context, ) = _settle(account);
        _rebalance(context, UFixed18Lib.ZERO);
    }

A malicious person can call this function specifying another user's address to disadvantage them at times when it would lead them to make a loss.

This is made possible because the update of prices is predictable. The malicious user could therefore time unfavorable price movements to disadvantage a user.

Impact

Griefing of vault users

Code Snippet

https://github.com/sherlock-audit/2023-05-perennial/blob/main/perennial-mono/packages/perennial-vaults/contracts/balanced/BalancedVault.sol#L146-L149

Tool used

Manual Review

Recommendation

Enforce a check to ensure that msg.sender == account in the syncAccount(address account) function.