Bauer - Use msg.sender instead of tx.origin

[sherlock-admin2]

Bauer

Medium

Use msg.sender instead of tx.origin

Summary

In the mint(), burn(), open(), close(), and liquidate() functions, the protocol uses tx.origin to identify the user. Using tx.origin makes users more vulnerable to phishing attacks.

Root Cause

https://github.com/sherlock-audit/2024-08-velar-artha/blob/main/gl-sherlock/contracts/core.vy#L166
https://github.com/sherlock-audit/2024-08-velar-artha/blob/main/gl-sherlock/contracts/core.vy#L202
https://github.com/sherlock-audit/2024-08-velar-artha/blob/main/gl-sherlock/contracts/core.vy#L241
https://github.com/sherlock-audit/2024-08-velar-artha/blob/main/gl-sherlock/contracts/core.vy#L281
https://github.com/sherlock-audit/2024-08-velar-artha/blob/main/gl-sherlock/contracts/core.vy#L318

The protocol uses tx.origin instead of msg.sender as the user to execute the subsequent operations.

user    : address       = tx.origin

Internal pre-conditions

External pre-conditions

Attack Path

1. A malicious attacker deploys a contract.
2. A user interacts with the malicious contract.
3. Within the malicious contract’s function, it calls mint(), burn(), open(), close(), or similar operations.

As a result, the user's assets can be manipulated without their authorization.

Impact

The user is subjected to a phishing attack.

PoC

@external
def mint(
id : uint256,
base_token : address,
quote_token : address,
lp_token : address,
base_amt : uint256,
quote_amt : uint256,
ctx : Ctx) -> uint256:

self._INTERNAL()

user : address = tx.origin

Mitigation

Use msg.sender instead of tx.origin.

Duplicate of #82