[WP-H4] anchor_basset_reward
pending yields can be stolen
#48
Labels
2 (Med Risk)
Assets not at direct risk, but function/availability of the protocol could be impacted or leak value
bug
Something isn't working
Lines of code
https://github.com/code-423n4/2022-02-anchor/blob/7af353e3234837979a19ddc8093dc9ad3c63ab6b/contracts/anchor-bAsset-contracts/contracts/anchor_basset_reward/src/user.rs#L80-L123
Vulnerability details
For yield farming aggregators, if the pending yield on an underlying strategy can be harvested and cause a surge of rewards to all existing investors, especially if the harvest can be triggered permissionlessly. Then the attacker can amplify the attack using a flash loan.
This is a well-known attack vector on Ethereum.
The root cause for this attack vector is that the pending yield is not settled to the existing users before issuing shares to new deposits.
In the current implementation of anchor_basset_reward/src/user.rs#execute_increase_balance() before L105, the
state.global_index
is not being upadted first.increase_balance
when calculate rewards.Because new user balance > old user balance, the user will take a part of the rewards belonging to other existing users.
https://github.com/code-423n4/2022-02-anchor/blob/7af353e3234837979a19ddc8093dc9ad3c63ab6b/contracts/anchor-bAsset-contracts/contracts/anchor_basset_reward/src/user.rs#L80-L123
PoC
Given:
anchor_basset_reward
increasedThe attacker can:
bond
a large amount of asset tokens- anchor_basset_hub will trigger
anchor_basset_token
to mint basset tokens to the attacker- anchor_basset_token will trigger
anchor_basset_reward
to IncreaseBalance for the attacker- anchor_basset_reward will use the old
state.global_index
to update the attacker'sholder.index
UpdateGlobalIndex
on anchor_basset_hubexecute_update_global_index()
and increaseglobal_index
for all usersAs of now, the attacker can get a large share of the pending yield. The attacker can claim the rewards and exit.
This process can be done in one transaction by using a smart contract, and the impact can be amplified by using a flash loan.
Recommendation
Consider changing to a similar approach like anchor_beth_reward/src/user.rs#L114, update
state.global_index
before changing the user's balance.And/or, transfer rewards and update
global_index
in one transaction.The text was updated successfully, but these errors were encountered: