Open sherlock-admin4 opened 5 months ago
The protocol team fixed this issue in the following PRs/commits: https://github.com/Axis-Fi/moonraker/pull/141
The protocol team fixed this issue in the following PRs/commits: Axis-Fi/moonraker#141
Fixed in https://github.com/Axis-Fi/moonraker/pull/130 by using uint256 hence avoiding unsafe casting. Confirmation tests added in PR 141
The Lead Senior Watson signed off on the fix.
I think all the issues regarding overflow/underflow should be duped with each other The root cause of all the issues are same i.e unsafe casting
dimulski
high
Overflow in curate() function, results in permanently stuck funds
Summary
The
Axis-Finance
protocol has a curate() function that can be used to set a certain fee to a curator set by the seller for a certain auction. Typically, a curator is providing some service to an auction seller to help the sale succeed. This could be doing diligence on the project andvouching
for them, or something simpler, such as listing the auction on a popular interface. A lot of memecoins have a big supply in the trillions, for example SHIBA INU has a total supply of nearly 1000 trillion tokens and each token has 18 decimals. With a lot of new memecoins emerging every day due to the favorable bullish conditions and having supply in the trillions, it is safe to assume that such protocols will interact with theAxis-Finance
protocol. Creating auctions for big amounts, and promising big fees to some celebrities or influencers to promote their project. The funding parameter in the Routing struct is of typeuint96
The max amount of tokens with 18 decimals a
uint96
variable can hold is around 80 billion. The problem arises in the curate() function, If the auction is prefunded, which all batch auctions are( a normal FPAM auction can also be prefunded), and the amount of prefunded tokens is big enough, close to 80 billion tokens with 18 decimals, and the curator fee is for example 7.5%, when thecuratorFeePayout
is added to the current funding, the funding will overflow.Vulnerability Detail
Gist After following the steps in the above mentioned gist, add the following test to the
AuditorTests.t.sol
To run the test use:
forge test -vvv --mt test_CuratorFeeOverflow
Impact
If there is an overflow occurs in the curate() function, a big portion of the tokens will be stuck in the
Axis-Finance
protocol forever, as there is no way for them to be withdrawn, either by an admin function, or by canceling the auction (if an auction has started, only FPAM auctions can be canceled), as the amount returned is calculated in the following wayCode Snippet
https://github.com/sherlock-audit/2024-03-axis-finance/blob/main/moonraker/src/AuctionHouse.sol#L665-L667
Tool used
Manual review & Foundry
Recommendation
Either remove the unchecked block
so that when overflow occurs, the transaction will revert, or better yet also change the funding variable type from
uint96
touint256
this way sellers can create big enough auctions, and provide sufficient curator fee in order to bootstrap their protocol successfully .