Closed sherlock-admin2 closed 3 months ago
Escalate
This is a valid dupe of #54
Escalate
This is a valid dupe of #54
You've created a valid escalation!
To remove the escalation from consideration: Delete your comment.
You may delete or edit your escalation comment anytime before the 48-hour escalation window closes. After that, the escalation becomes final.
escalate dups of https://github.com/sherlock-audit/2024-03-arrakis-judging/issues/54
escalate dups of https://github.com/sherlock-audit/2024-03-arrakis-judging/issues/54
You've created a valid escalation!
To remove the escalation from consideration: Delete your comment.
You may delete or edit your escalation comment anytime before the 48-hour escalation window closes. After that, the escalation becomes final.
Seems valid dup of #54 @0xffff11 @WangSecurity
Agree with the escalation and planning to make it a duplicate of #54. But, only the first escalation by @0xjuaan will accepted and the second one by @cu5t0mPeo will be rejected, based on the following rule for escalation:
If there were previous escalations for the same issue (let's say it's the second escalation), it won't be accepted unless the new argument proposes new changes or provides stronger reasons for the changes requested earlier.
Result: Medium Duplicate of #54
cu5t0mPe0
high
The way ArrakisPublicVaultRouter and ValantisHOTModulePublic calculate the deposit amount is inconsistent.
Summary
ArrakisPublicVaultRouter rounds down when calculating the deposit amount, while ValantisHOTModulePublic rounds up. This discrepancy could result in the deposit amount for ValantisHOTModulePublic exceeding the allowance, causing the transaction to fail.
Vulnerability Detail
When a user makes a deposit,
_getMintAmounts
is first called to calculate the actual deposit amount. The calculation process rounds down.https://github.com/sherlock-audit/2024-03-arrakis/blob/64a7dc6ccb5de2824870474a9f35fd3386669e89/arrakis-modular/src/ArrakisPublicVaultRouter.sol#L139-L141
Then call
safeIncreaseAllowance
to increase the module's allowance value.https://github.com/sherlock-audit/2024-03-arrakis/blob/64a7dc6ccb5de2824870474a9f35fd3386669e89/arrakis-modular/src/ArrakisPublicVaultRouter.sol#L869-L901
In the module, the deposit amount is recalculated, and this time the calculation process rounds up. Therefore, the result calculated in the module is likely to be larger than the result calculated by
ArrakisPublicVaultRouter
, causing the allowance to be insufficient and the transaction to fail.This vulnerability scenario primarily occurs in cases where the amounts cannot be evenly divided, making it highly likely to occur and potentially leading to a dos attack on the deposit function.
poc:
Place the following test into
ArrakPublicVaultRouter.t.sol
and run it, commenting out thetransferFrom
inArrakisPublicVaultMock.sol::mint
.将下面测试文件放入ValantisHOTModulePublic.t.sol中运行,并且将setUp中的INIT1改为1e18 + 232323
results:
It can be seen from the results that the amount deposited in the module is 100000000000131711, but the allowance value in the router will be 100000000000131710, causing the deposit to fail.
Impact
User cannot deposit
Code Snippet
https://github.com/sherlock-audit/2024-03-arrakis/blob/64a7dc6ccb5de2824870474a9f35fd3386669e89/arrakis-modular/src/ArrakisPublicVaultRouter.sol#L1228-L1229
Tool used
Manual Review
Recommendation
ArrakisPublicVaultRouter also needs to be rounded up
Duplicate of #54