Skip to content

Latest commit

 

History

History
60 lines (39 loc) · 2.02 KB

051.md

File metadata and controls

60 lines (39 loc) · 2.02 KB

Slow Tan Swallow

High

Creators can be DOSed

Summary

When vouching the creator who we vouch for is checked for if it has more than the max allowed vouchers. If it does the TX revert, not allowing us to vouch for him.

https://github.com/sherlock-audit/2024-11-ethos-network-ii/blob/main/ethos/packages/contracts/contracts/EthosVouch.sol#L371-L377

    if (vouchIdsForSubjectProfileId[subjectProfileId].length >= maximumVouches) {
      revert MaximumVouchesExceeded(
        vouchIdsForSubjectProfileId[subjectProfileId].length,
        "Exceeds subject vouch limit"
      );
    }

However this can be abused, by simply creating multiple accounts and vouching for a said creator with the minimum allowed amount (ABSOLUTE_MINIMUM_VOUCH_AMOUNT) which is 0.0001 ETH in order to prevent other honest vouchers who would have vouched bigger amounts (1 ETH or 10 ETH).

Root Cause

Max allowed vouches per creator

    if (vouchIdsForSubjectProfileId[subjectProfileId].length >= maximumVouches) {
      revert MaximumVouchesExceeded(
        vouchIdsForSubjectProfileId[subjectProfileId].length,
        "Exceeds subject vouch limit"
      );
    }

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

  1. User does not like a creator and wants to DOS him and his vouchers
  2. User creates multiple profiles and vouches for said creator with the min allowed amount
  3. Since the chain is base and the min allowed amount is so little, it will take a few bucks to fully prevent a user from receiving vouches with actual value

Impact

Users who are vouched for might have limited (or none) real vouchers. maximumVouches can be any number with the highest being 256, which means that the lower this number is, the easier for a user to be DOS in such a way.

PoC

No response

Mitigation

Either allow infinite vouchers, where vouchers are minted 4626 vault shares (in order for vouchersPoolFee to work properly), or allow users to remove some of their vouchers.