Skip to content

Latest commit

 

History

History
58 lines (36 loc) · 2.09 KB

052.md

File metadata and controls

58 lines (36 loc) · 2.09 KB

Slow Tan Swallow

Medium

First voucher attack

Summary

When vouching for a user, you are forced to pay 3 fees protocolFee, donationFee and vouchersPoolFee, where the last is split between all the existing voucher based on their shares/balances. However if you are the first voucher since there are not other voucher you will not pay a fee and _rewardPreviousVouchers will return 0.

https://github.com/sherlock-audit/2024-11-ethos-network-ii/blob/main/ethos/packages/contracts/contracts/EthosVouch.sol#L706-L717

  function _rewardPreviousVouchers(
    uint256 amount,
    uint256 subjectProfileId
  ) internal returns (uint256 amountDistributed) {
    // ...

    if (totalBalance == 0) {
      return totalBalance;
    }

However if you are the second voucher, you pay 100% of your fee to the first one, no matter his balance, since he would be the only "share" holder of that vouch.

Root Cause

First voucher being given 100% of the fee, despite his minimal vouch.

Internal pre-conditions

A user to be vouched for

External pre-conditions

Users who want to vouch for another user

Attack Path

  1. User registers his account
  2. Alice sees that and wants to vouch for said user 10 ETH
  3. However Bob front-runs her and vouches 0.0001 ETH
  4. Bob gets the full vouchersPoolFee (5% in this case) which is 0.5 ETH
  5. Bob unvouches his balance and takes home the profit

Note that a front-run is not always required for such attacks, if the user who is making the account is famous enough (100k followers on twitter for example) and announces that he is gonna be making an account, then a lot of users would rush in to vouch. A bot can simply observe the chain and back-run his account creation.

Impact

First voucher attack will cause the first user to pay a massive fee to someone who is just here to exploit the new account creation.

PoC

No response

Mitigation

The fee paying mechanism although interesting can pose a huge risk to it's users. Consider changing it's mechanics in order to split the fee in a way that would not allow such users to exploit new subjects.