Skip to content

Latest commit

 

History

History
58 lines (35 loc) · 1.92 KB

077.md

File metadata and controls

58 lines (35 loc) · 1.92 KB

Fast Cerulean Armadillo

High

updateDownsideProtected function lacks access control

Summary

The CDS contract updateDownsideProtected function lacks proper access control, allowing any user to update the downsideProtected value arbitrarily. This can lead to a denial-of-service (DoS) attack, disrupting deposits and withdrawals.

Root Cause

The root cause of the vulnerability is the absence of access control in the updateDownsideProtected function. Any user can call this function and increase downsideProtected without restriction.

function updateDownsideProtected(uint128 downsideProtectedAmount) external {
    downsideProtected += downsideProtectedAmount;
}

https://github.com/sherlock-audit/2024-11-autonomint/blob/0d324e04d4c0ca306e1ae4d4c65f0cb9d681751b/Blockchain/Blockchian/contracts/Core_logic/CDS.sol#L829

Setting downsideProtected higher than totalCdsDepositedAmount would DOS deposit and withdrawals because of underflow.

    function _updateCurrentTotalCdsDepositedAmount() private {
        if (downsideProtected > 0) {
            totalCdsDepositedAmount -= downsideProtected;

Or setting lower values would make totalCdsDepositedAmount different and broke the all contract calculations

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

  1. The attacker calls updateDownsideProtected with a very high value.
  2. The _updateCurrentTotalCdsDepositedAmount function reduces totalCdsDepositedAmount by downsideProtected, causing setting the value to zero.
  3. withdrawals and other operations fail due to incorrect values in totalCdsDepositedAmount, breaking core protocol logic.

Impact

Deposits and withdrawals are disrupted. The total deposited amount is manipulated, causing incorrect calculations throughout the contract.

PoC

No response

Mitigation

Restrict updateDownsideProtected to only authorized borrowing contract