Skip to content

062.md

Latest commit

 

History

History
50 lines (32 loc) · 2.64 KB

062.md

File metadata and controls

50 lines (32 loc) · 2.64 KB

Attractive Raisin Sheep

High

Deposit and Withdraw Functions Can Always Revert in CDS.sol

Summary

The deposit and withdraw functions in the CDS.sol contract can always revert because any user can increase the storage variable downsideProtected as they wish.

Root Cause

In CDS.sol:829 there is a missing check on updateDownsideProtected function. Thus anyone can increase downsideProtected as they wish.

    function updateDownsideProtected(uint128 downsideProtectedAmount) external {
        downsideProtected += downsideProtectedAmount;
    }

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

  1. An attacker calls the updateDownsideProtected function on the CDS contract with downsideProtectedAmount set to nearly type(uint256).max. https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/Core_logic/CDS.sol#L829
  2. As a result, the deposit and withdraw functions will always revert for all subsequent calls made by users.

Impact

The CDS contract will be rendered inoperable since the deposit and withdraw functions, which are core features of this contract, will always revert. In short, CDS contract will be broken.

PoC

The _updateCurrentTotalCdsDepositedAmount function is invoked within the deposit and withdraw functions to adjust totalCdsDepositedAmount and totalCdsDepositedAmountWithOptionFees based on the downsideProtected amount. https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/Core_logic/CDS.sol#L234 https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/Core_logic/CDS.sol#L324 If anyone sets downsideProtected to nearly type(uint256).max, these calculations will always fail and cause a revert because of underflow of uint256. https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/Core_logic/CDS.sol#L835

Mitigation

Restrict the updateDownsideProtected function so that it can only be called by the admin or owner of the contract(it can be core contracts in this protocol).