008.md

Shambolic Cotton Pangolin

High

withdrawGraduatedMarketFunds will try to send more eth than there actually is

Summary

In the sellVotes function the marketFunds will be updated incorrectly leading to the protocol assuming there are more funds than there actually are.

Root Cause

When we check the sellVotes function we see that it performs the following storage update: https://github.com/sherlock-audit/2024-11-ethos-network-ii/blob/57c02df7c56f0b18c681a89ebccc28c86c72d8d8/ethos/packages/contracts/contracts/ReputationMarket.sol#L522 However only the funds received by the seller are subtracted from the marketFunds while in fact the actual amount that is being withdraw is fundsReceived+protocolFee. As a result it will make the protocol assume that his protocolFee is still in the marketFunds, and will try to pull it here in the withdrawGraduatedMarketFunds function: https://github.com/sherlock-audit/2024-11-ethos-network-ii/blob/57c02df7c56f0b18c681a89ebccc28c86c72d8d8/ethos/packages/contracts/contracts/ReputationMarket.sol#L675

Internal pre-conditions

N/A

External pre-conditions

N/A

Attack Path

It will happen everytime the sellVotes function is executed.

Impact

Potential DOS as at some point the contract will not have enough assets to call withdrawGraduatedMarketFunds Also more assets will be sent anytime withdrawGraduatedMarketFunds funds is called including the fee. - High

PoC

N/A

Mitigation

In the sellVotes function calculate the marketFunds as follows:

marketFunds[profileId] -= fundsReceived + protocolFee;