Closed sherlock-admin4 closed 3 months ago
Escalate The user can exploit this method to dilute other users' shares, causing them to lose funds.
You've deleted an escalation for this issue.
Hi, I believe this is invalid because it uses calculations from the mock, which are different to the calculations in the actual contracts.
The actual ValantisHOTModule
rounds up when calculating amount0
and amount1
@0xjuaan Hi, when the value of 1 share increases over time due to fees collected in the pool, if 1 share is worth 2 tokens but a user deposits only 1 token to receive a share (with rounding up in calculations).
if 1 share is worth 2 tokens, then in order to mint a share, they would have to pay 2 tokens (not 1)
show a PoC using the actual ValantisHOTModule
calculations if you disagree please
cu5t0mPe0
high
The attacker can steal funds from the pool.
Summary
The attacker uses rounding up to obtain 1 share for the amount of 1 token.
Vulnerability Detail
The attacker uses
ArrakisMetaVaultPublic.mint
for deposits, acquiring only 1 share each time. Due to rounding up, the calculated proportion value also becomes 1. InValantisHOTModulePublic.deposit
, rounding up occurs as well. Therefore, when the numerator is less than the denominator, the calculation shows that a user only needs to deposit 1 token to obtain 1 share.If a user deposits through
ArrakisPublicVaultRouter
, the calculation inValantisHOTModulePublic.deposit
for the deposit amount is correct. However, when users useArrakisMetaVaultPublic.mint
, the tokens are not converted into equivalent decimals. For tokens with lower decimals, the calculation remains 0, but due to rounding up, it is calculated as 1.As the fees collected increase, shares become more valuable. However, attackers can exploit this method to acquire shares at a lower cost.
Ultimately, large amounts of shares are obtained through dust amounts.
coding poc:
This proof of concept (PoC) is derived from
testMint
. Due to the use of floor rounding in LpModuleMock's calculations, both amount0 and amount1 compute to 0. However, if rounded up, they would compute to 1.Impact
An attacker can steal all balances in the pool
Code Snippet
https://github.com/sherlock-audit/2024-03-arrakis/blob/64a7dc6ccb5de2824870474a9f35fd3386669e89/arrakis-modular/src/modules/ValantisHOTModulePublic.sol#L71-L74
Tool used
Manual Review
Recommendation
Although
ArrakisMetaVaultPublic.mint
can be called by anyone, which is intentionally designed by the project team, it is recommended that only the router should be able to call it.