chinepun - Rebate_to account not validated during Swapping

[sherlock-admin3]

chinepun

Medium

Rebate_to account not validated during Swapping

Summary

There is a missing check to the rebate account when swapping is performed, hence any account could be passed into the rebate account.

Root Cause

rebate_to account not validated

Internal pre-conditions

Any user can call this instruction and pass any account as the rebate_to account

Attack Path

Calling the swap instruction and passing any account to the rebate_to account is enough to trigger this functionality

Impact

There is little impact as these account is only emitted through an event but this emitted event could be used to trick event listeners in the case of an actual attack scenario.

PoC

Passing any account into the rebate_to account when the swap instruction is called

Mitigation

Validate rebate_to account by performing the following steps

Step 1 Add

[dependencies.rebate_manager]
path = "../rebate_manager"

to Cargo.toml

Step 2 Make the state module public pub mod state;

Step 3 Verify rebate_to account is owned by the rebate_manager program and add other custom checks rebate_to: Account<'info, rebate_manager::state::rebate_info::RebateInfo>, in swap.rs

[toprince]

Not valid for this one. No need to check if the account is valid. If the account is not valid in rebate manager, then we can save the rebate fee.