-
Notifications
You must be signed in to change notification settings - Fork 6
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
setUnboundedKerosineVault not called during deployment, causing reverts when querying for Kerosene value after adding it as a Kerosene vault #829
Comments
JustDravee marked the issue as high quality report |
JustDravee marked the issue as primary issue |
doesn't necessarily needs to be called in the deployment script |
koolexcrypto marked the issue as unsatisfactory: |
While the sponsor comment is true, the documentation in the contest's README explicitly states: This finding shows that this is in fact not the case and that the comments in the provided documentation suggest the team were unaware this would be an issue. Given the deploy script is within the scope of the contest I believe this issue is a valid finding. If this issue had not been raised and the protocol had deployed as they previously outlined, users who deposit would have their funds stuck (due to both the |
Thanks for your input. The statement in README is about the migration from VaultManager to VaultManagerV2.
Not sure how the funds will be stuck if the |
Funds will be stuck because the value of all a users collateral is checked on withdraw (not just the collateral they're attempting to withdraw) in the |
Consider L04 from my QA report if this report is being validated: #980 |
Thank you for your further explanation. After reviewing README and the comments above again, because of 1- There is an impact (clarified already by the warden) that will make the protocol not function.
I believe, it would be unfair to mark this as QA, will upgrade to Medium. |
koolexcrypto removed the grade |
koolexcrypto marked the issue as selected for report |
Lines of code
https://github.com/code-423n4/2024-04-dyad/blob/cd48c684a58158de444b24854ffd8f07d046c31b/script/deploy/Deploy.V2.s.sol#L78-L82
https://github.com/code-423n4/2024-04-dyad/blob/cd48c684a58158de444b24854ffd8f07d046c31b/src/core/Vault.kerosine.bounded.sol#L23-L30
https://github.com/code-423n4/2024-04-dyad/blob/cd48c684a58158de444b24854ffd8f07d046c31b/README.md?plain=1#L66-L68
Vulnerability details
Root Cause
The
setUnboundedKerosineVault
function was never called during deployment, nor was it planned to be called post deployment.Impact
Without setting the
unboundedKerosineVault
, any attempt to get the asset price of a dNFT that has uses the bounded Kerosene vault will result in a revert.Note Regarding Vault Licenser
VaultManagerV2
'saddKerosene()
erroneously does a vault license check usingkeroseneManager.isLicensed(vault)
at VaultManagerV2.sol#L88 making it impossible to add Kerosene vaults to Notes. As clarified by the sponsor in this video DYAD V2- Kerosene - Code4rena Audit #2, the vaults inkeroseneManager
are intended to be used for kerosene value calculation and kerosene vaults are not supposed to be added there. We updated the relevant Kerosene vault license checks to usevaultLicenser.isLicensed(vault)
instead as it is aligned with the deployment script at Deploy.V2.s.sol#L95 sinceunboundedKerosineVault
is added as a licensed vault withvaultLicenser.add(address(unboundedKerosineVault))
The two following code changes were made to
VaultManagerV2.sol
so that the unbounded kerosene vault can be added as a kerosene vault without further changes in the vaults, the vault manager, or the deployment script.VaultManagerV2.sol#L88
From:
To:
and VaultManagerV2.sol#L280
From:
To:
Proof of Concept
The following test script demonstrates that the
getKeroseneValue
function reverts when theunboundedKerosineVault
is not set during deployment.Tools Used
Manual testing
Recommended Mitigation Steps
Set the
unboundedKerosineVault
during deployment.Changes to
DeployV2
Call the
setUnboundedKerosineVault
function during deployment after deploying the bounded Kerosene vault at Deploy.V2.s.sol#L78-L82:boundedKerosineVault.setUnboundedKerosineVault(unboundedKerosineVault);
Assessed type
Other
The text was updated successfully, but these errors were encountered: