Closed sherlock-admin3 closed 4 months ago
Escalate
This is a duplicate of issue #273, which is considered valid.
Escalate
This is a duplicate of issue #273, which is considered valid.
You've created a valid escalation!
To remove the escalation from consideration: Delete your comment.
You may delete or edit your escalation comment anytime before the 48-hour escalation window closes. After that, the escalation becomes final.
Agree with the escalation, planning to accept and duplicate with #273
Result: Medium Duplicate of #273
fibonacci
high
TitlesGraph's acknowledge/unacknowledge edge functions DoS
Summary
TitlesGraph's acknowledge/unacknowledge edge functions, which utilize signatures, can be susceptible to front-running and blocking.
Vulnerability Detail
A user can acknowledge an edge by using an ECDSA signature.
The signed message does not include information about the action being performed.
Consequently, the same signature can be used to both acknowledge and unacknowledge an edge.
A malicious user can front-run a call and use the same signature for the opposite action.
Impact
acknowledge
function.unacknowledge
function with the same signature.Code Snippet
https://github.com/sherlock-audit/2024-04-titles/blob/main/wallflower-contract-v2/src/graph/TitlesGraph.sol#L118-L124 https://github.com/sherlock-audit/2024-04-titles/blob/main/wallflower-contract-v2/src/graph/TitlesGraph.sol#L146-L152 https://github.com/sherlock-audit/2024-04-titles/blob/main/wallflower-contract-v2/src/graph/TitlesGraph.sol#L40-L50
Tool used
Manual Review
Recommendation
Duplicate of #273