Closed sherlock-admin2 closed 3 months ago
@0xffff11 Hi, I believe this is a duplicate of #50 as well, together with the #21 as it refers to the same issue.
Escalate
This is a valid dupe of #50
Escalate
This is a valid dupe of #50
You've created a valid escalation!
To remove the escalation from consideration: Delete your comment.
You may delete or edit your escalation comment anytime before the 48-hour escalation window closes. After that, the escalation becomes final.
Agree with escalation and planning to duplicate with #50
Result: High Duplicate of #50
iamandreiski
high
Executor can steal all funds from public vault when a new module is set
Summary
After a new module has been whitelisted (which is a timelocked process), the next step is for the executor role of the given public vault to call
setModule()
on the ArrakisStandardManager in order to set the new whitelisted module. The problems which cause this attack scenario to be possible are:setModule()
being called by the executor isn't a timelocked operation, i.e. it will be executed immediately.Vulnerability Detail
When the vault owner wants to whitelist a new module, the step-by-step flow would be:
Calling
whitelistModules
on the public vault:setModule()
on the Manager calls thesetModule()
function on the public vault, it will check if the module address is whitelisted, and if it is, it will withdraw the manager balance and transfer all funds from the old module to the new one.Impact
Executor can steal all public vault funds when a new module is being set.
Code Snippet
https://github.com/sherlock-audit/2024-03-arrakis/blob/64a7dc6ccb5de2824870474a9f35fd3386669e89/arrakis-modular/src/abstracts/ArrakisMetaVault.sol#L97-L134 https://github.com/sherlock-audit/2024-03-arrakis/blob/64a7dc6ccb5de2824870474a9f35fd3386669e89/arrakis-modular/src/ArrakisStandardManager.sol#L429-L441
Tool used
Manual Review
Recommendation
Either check the payload data before its executed to make sure that it's not malicious, and/or timelock the executor role as well.
Duplicate of #50