Skip to content

Latest commit

 

History

History
43 lines (25 loc) · 1.48 KB

085.md

File metadata and controls

43 lines (25 loc) · 1.48 KB

Cheesy Cinnabar Mammoth

Medium

SellVotes doesn't offer the same slippage protection that buyVotes() does

Summary

Ethos utilizes slippage protection on buyVotes, however, this protection is not offered on sellVotes() and leaves users vulnerable to market manipulation.

Root Cause

Lack of slippage protection for sellVotes() https://github.com/sherlock-audit/2024-11-ethos-network-ii/blob/main/ethos/packages/contracts/contracts/ReputationMarket.sol#L495-L498

Internal pre-conditions

  1. The attacker must already hold either TRUST or DISTRUST votes in the market they plan on manipulating. The attack is more likely to be performed in markets the attacker wants to hold certain votes in.

External pre-conditions

  1. An attacker has some indication that a user will call sellVotes() on a market the attacker belongs to.

Attack Path

  1. Let's say there are 500 TRUST votes and 250 DISTRUST votes
  2. A user wants to sell 100 TRUST votes so they call sellVotes() passing in 100 as a parameter. The price of the first vote should sell for 500 * .01e18 / 750 = 0.0066e18 and then decrease linearly from there.
  3. An attacker owns 100 TRUST votes so they sell their votes first
  4. So now the price of the first vote should sell for is 400 * .01e18 / 650 = 0.0061e18
  5. The attacker then rebuys their 100 TRUST votes.
  6. The user loses the variance per vote

Impact

Loss of funds for vote sellers

PoC

No response

Mitigation

Add slippage protection to sellVote()