Skip to content

Latest commit

 

History

History
53 lines (27 loc) · 2.39 KB

009.md

File metadata and controls

53 lines (27 loc) · 2.39 KB

Obedient Lava Monkey

Medium

withdrawETHWithPermit bypasses user-specified approval limits, enabling unauthorized full withdrawals.

Summary

The missing validation of permit for the actual amountToWithdraw in withdrawETHWithPermit will cause unauthorized withdrawals for users as malicious actors will exploit mismatched approval limits to withdraw the user's full balance.

Root Cause

In WrappedTokenGatewayV3.sol, the permit function validates approval for amount, but transferFrom is called with amountToWithdraw, potentially exceeding the user's intent.

When amount is set to type(uint256).max, the amountToWithdraw value is overridden to the user's full balance, regardless of the initial amount specified in the permit. This creates a mismatch between the permit approval (which is for amount) and the actual amountToWithdraw being processed.

Internal Pre-conditions

  1. User signs a permit for amount (e.g., limited approval).
  2. User's aWETH balance is greater than or equal to amountToWithdraw.
  3. Function input sets amount to a lower value than amountToWithdraw or type(uint256).max.

External Pre-conditions

No restrictions are placed on amountToWithdraw being higher than the approved amount.

Attack Path

  1. Attacker calls withdrawETHWithPermit with:
  • amount == permit-limited approval.
  • amountToWithdraw == user’s full aWETH balance.
  1. Contract calls permit for the lesser amount, successfully validating the signature.
  2. Contract executes transferFrom with amountToWithdraw, bypassing the intent of the user.
  3. Excessive aWETH is withdrawn and unwrapped into ETH for the attacker.

Impact

The user suffers a loss of their entire aWETH balance if amountToWithdraw exceeds their intended withdrawal limit. The attacker gains control of the withdrawn ETH.

PoC

Validate the permit approval for amountToWithdraw instead of amount by modifying permit parameters in WrappedTokenGatewayV3.sol`

Mitigation

Validate the permit approval for amountToWithdraw instead of amount by modifying permit parameters in WrappedTokenGatewayV3.sol