Skip to content

Latest commit

 

History

History
47 lines (28 loc) · 2.02 KB

081.md

File metadata and controls

47 lines (28 loc) · 2.02 KB

Cheesy Cinnabar Mammoth

High

Overwithdrawal Due to Misaccounted Market Funds

Summary

When a user calls buyVotes() on a market, the marketFunds state variable incorrectly tracks funds by including protocol fees and donations in its total, leading to an over-withdrawal when markets are graduated. While protocol fees are immediately sent to protocolFeeAddress and donations are tracked in donationEscrow, these amounts remain counted in marketFunds. This double counting causes the protocol to withdraw more funds than it should when calling withdrawGraduatedMarketFunds().

Root Cause

In the _calculateBuy() function, fees and donations are added to fundsPaid, rather than just the amount paid for votes: https://github.com/sherlock-audit/2024-11-ethos-network-ii/blob/main/ethos/packages/contracts/contracts/ReputationMarket.sol#L978

Then in buyVotes(), marketFunds is increased by fundsPaid: https://github.com/sherlock-audit/2024-11-ethos-network-ii/blob/main/ethos/packages/contracts/contracts/ReputationMarket.sol#L481

Internal pre-conditions

  1. At least the protocol fee or donation fee is non-zero
  2. Market is graduated
  3. withdrawGraduatedMarketFunds is called

External pre-conditions

  1. 2 or more markets are created
  2. Votes are purchases for 2 or more markets

Attack Path

  1. A market is created
  2. A user calls buyVotes() to buy votes for that market. marketFunds is increased by the amount the user paid for votes + the protocol fee + the donation amount. Fees are sent to the protocol and donations are updated.
  3. The donation recipient calls withdrawDonations to withdraw their donations.
  4. The protocol graduates the market and then calls withdrawGraduatedMarketFunds which withdraws not just the amount the user paid for votes, but also the protocol fee and donations again.

Impact

Loss of funds since protocol fee and donations are being double counted.

PoC

No response

Mitigation

Don't include the protocol fee and the donation amount when updating marketFunds