Formal Cornflower Halibut - Open call in OracleLess.sol can be used for unauthorized calling

[sherlock-admin3]

Formal Cornflower Halibut

High

Open call in OracleLess.sol can be used for unauthorized calling

Summary

Users can fill OracleLess order with any pending order ERC20 address and use the open call in OracleLess::execute by filling the order through fillOrder to execute approve and steal all the staked funds.

Root Cause

There is no data validation in fillorder which can be used to pass arbitrary data to OracleLess::execute function and this function performs a open call

   function execute(
        address target,
        bytes calldata txData,
        Order memory order
    ) internal returns (uint256 amountOut, uint256 tokenInRefund) {
        //update accounting
        uint256 initialTokenIn = order.tokenIn.balanceOf(address(this));
        uint256 initialTokenOut = order.tokenOut.balanceOf(address(this));

        //approve
        order.tokenIn.safeApprove(target, order.amountIn);

        //perform the call
        (bool success, bytes memory reason) = target.call(txData);

        if (!success) {
            revert TransactionFailed(reason);
        }

        uint256 finalTokenIn = order.tokenIn.balanceOf(address(this));
        require(finalTokenIn >= initialTokenIn - order.amountIn, "over spend");
        uint256 finalTokenOut = order.tokenOut.balanceOf(address(this));

        require(
            finalTokenOut - initialTokenOut > order.minAmountOut,
            "Too Little Received"
        );

        amountOut = finalTokenOut - initialTokenOut;
        tokenInRefund = order.amountIn - (initialTokenIn - finalTokenIn);
    }

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

1 Attacker checks for the highest staked tokens in OracleLess or any ERC20
2 Then executes a fillOrder function call with txData to call approve function on any ERC-20 token address as target parameter and authorize attacker's address for spending funds

Impact

Stealing of funds

PoC

No response

Mitigation

No response