The borrower can steal all SOL from the lender by paying almost nothing as a collateral #13
Labels
3 (High Risk)
Assets can be stolen/lost/compromised directly
bug
Something isn't working
duplicate-26
🤖_04_group
AI based duplicate group recommendation
satisfactory
satisfies C4 submission criteria; eligible for awards
Lines of code
https://github.com/code-423n4/2024-04-lavarage/blob/main/libs/smart-contracts/programs/lavarage/src/processor/swapback.rs#L43-L63
Vulnerability details
Impact
Due to the lack of seed validation on
borrow_collateral
function, the borrower can steal all SOL from the lender by paying almost nothing as a collateral. This can be done as follows:Check the PoC below, It demonstrates how a thief could perform the scenario above.
Note: this is different from the other issue reported (completly different root cause and slightly different impact)
Proof of Concept
Please create a file
tests/poc_steal_sol_lavarage.spec.ts
) , then run the following command:ORACLE_PUB_KEY=ATeSYS4MQUs2d6UQbBvs9oSNvrmNPU1ibnS2Dmk21BKZ anchor test
You should see the following output:
Summary of balances:
Test file
Tools Used
Manual analysis
Recommended Mitigation Steps
Add this to
borrow_collateral
function to validate the seedAfter adding this mitigation, if you run the attack above, it will fail.
Assessed type
Invalid Validation
The text was updated successfully, but these errors were encountered: