End epoch cannot be triggered preventing winners to withdraw #278
Labels
3 (High Risk)
Assets can be stolen/lost/compromised directly
bug
Something isn't working
high quality report
This report is of especially high quality
selected for report
This submission will be included/highlighted in the audit report
sponsor confirmed
Sponsor agrees this is a problem and intends to fix it (OK to use w/ "disagree with severity")
Lines of code
https://github.com/code-423n4/2022-09-y2k-finance/blob/2175c044af98509261e4147edeb48e1036773771/src/Controller.sol#L198
https://github.com/code-423n4/2022-09-y2k-finance/blob/2175c044af98509261e4147edeb48e1036773771/src/Controller.sol#L246
https://github.com/code-423n4/2022-09-y2k-finance/blob/2175c044af98509261e4147edeb48e1036773771/src/Controller.sol#L261
https://github.com/code-423n4/2022-09-y2k-finance/blob/2175c044af98509261e4147edeb48e1036773771/src/Controller.sol#L277-L286
https://github.com/code-423n4/2022-09-y2k-finance/blob/2175c044af98509261e4147edeb48e1036773771/src/Vault.sol#L203
Vulnerability details
Impact
At the end of an epoch, the triggerEndEpoch(...) is called to trigger 'epoch end without depeg event', making risk users the winners and entitling them to withdraw (risk + hedge) from the vault.
In the case of the Arbitrum sequencer going down or restarting, there is a grace period of one hour before the getLatestPrice() returns to execute without reverting. This means that the triggerEndEpoch(...) cannot complete during this time, because it calls the getLatestPrice().
Making this high-priority because unless the triggerEndEpoch(...) completes:
First two points each constitute independent jsutification, thrid point reinforces the first 2 points.
Proof of Concept
triggerEndEpoch reverts if arbiter down or restarted less than eq GRACE_PERIOD_TIME ago (1hr)
File: Controller.sol:L246
Revert if getLatestPrice reverts.
File: Controller.sol:L277-L286
Revert if sequencer down or grace period after restart not over.
withdraw fails if triggerEndEpoch did not execute successfully
File: Vault.sol:L203
Can execute if block.timestamp > epochEnd, but fails if trigger did not execute. Winners cannot withdraw.
Tools Used
n/a
Recommended Mitigation Steps
The latest price is retrieved at the very end of the triggerEndEpoch(...) for the only purpose of initializing the DepegInsurance event.
Since it is used for informational purpose (logging / offchain logging) and not for functional purpose to the triggerEndEpoch(...) execution, it can be relaxed.
Depending on how the event is used, when getLatestPrice() is called for informative/logging purpose only, there could be few alternatives:
Once events are logged off-chain, some post processing may be used to correct/update the values with accurate data.
The text was updated successfully, but these errors were encountered: