search

sherlock-audit / 2024-06-makerdao-endgame-judging

5 stars 3 forks source link

zraxx - The function `redo` can be used to steal all funds in `vat`. #29

Closed sherlock-admin3 closed 3 months ago

sherlock-admin3 commented 3 months ago

zraxx

High

The function redo can be used to steal all funds in vat.

Summary

The lack of permission check for the redo function in LockstakeClipper.sol will result in the function redo being called arbitrarily, thereby stealing incentive funds.

Root Cause

https://github.com/sherlock-audit/2024-06-makerdao-endgame/blob/main/lockstake/src/LockstakeClipper.sol#L275-L313 Lack of permission check for the redo function.

Internal pre-conditions

  1. The auth user sets the chip or tip to larger than 0
  2. The auth user first calls the function kick to start the auction.
  3. Attackers calls the function redo repeatedly to steal the incentive funds.

External pre-conditions

No response

Attack Path

  1. Attackers calls the function redo repeatedly to steal the incentive funds.

Impact

All the funds in vat will be stolen by attackers.

PoC

No response

Mitigation

Add the auth check for the function redo.

sunbreak1211 commented 3 months ago

There is a check if the auction needs a reset -https://github.com/sherlock-audit/2024-06-makerdao-endgame/blob/main/lockstake/src/LockstakeClipper.sol#L289