006.md

Round Neon Kestrel

Medium

Reentrancy attack in collateral commitment

Summary

The lack of reentrancy protection in the commitCollateral() function will cause a vulnerability for the protocol as an attacker can re-enter the function, causing unintended behavior and potentially draining the collateral.

Root Cause

In CollateralManager.sol:88, the function commitCollateral() involves a state-changing operation (mapping update) and a token transfer without any reentrancy protection. This could lead to a reentrancy attack where an attacker can recursively call commitCollateral() and manipulate the state during the process.

Internal pre-conditions

1. Attacker needs to invoke commitCollateral() while holding control over the execution flow, such as through an external call to a vulnerable contract.

2. The attacker needs to ensure the collateral is of a valid type and has sufficient amount to be deposited.

External pre-conditions

Attacker needs to control a malicious contract that can re-enter commitCollateral() during execution.

Attack Path

1. The attacker creates a malicious contract that calls commitCollateral().
2. During execution, the malicious contract re-enters the function, manipulating collateral or bypassing checks.

Impact

The protocol suffers potential collateral loss, as attackers can repeatedly deposit collateral without it being properly accounted for, draining assets from the protocol. The attacker gains the ability to manipulate collateral deposits, causing financial loss.

PoC

No response

Mitigation

Use a ReentrancyGuard modifier or implement the checks-effects-interactions pattern to prevent reentrancy issues.