Sparkn

CodeFox Inc.
DeFiFoundryProxy
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Attacker can steal funds via a reorg attack if the position is funded within a few blocks of being created

jaraxxus

Summary

Attacker can steal funds via a reorg attack if the position is funded within a few blocks of being created

Vulnerability Details

The owner will create a contest and precompute the contract address and the sponsor will deposit money into a contract address that is not deployed yet.

function setContest(address organizer, bytes32 contestId, uint256 closeTime, address implementation)
public
onlyOwner
{
if (organizer == address(0) || implementation == address(0)) revert ProxyFactory__NoZeroAddress();
if (closeTime > block.timestamp + MAX_CONTEST_PERIOD || closeTime < block.timestamp) {
revert ProxyFactory__CloseTimeNotInRange();
}
-> bytes32 salt = _calculateSalt(organizer, contestId, implementation); //@audit -- salt value is known
if (saltToCloseTime[salt] != 0) revert ProxyFactory__ContestIsAlreadyRegistered();
saltToCloseTime[salt] = closeTime;
-> emit SetContest(organizer, contestId, closeTime, implementation);
}

In the case of a reorg attack, an attacker can create that same contract address because he knows the salt value through the SetContest event emitted which gives the organizer, contestId and implementation. If the sponsor does not know that there is a reorg, he will deposit the funds into the attacker's contract instead.

Re-orgs can happen in all EVM chains. In ethereum, it is not "super common" but it still happens, being the last one less than a year ago:

https://decrypt.co/101390/ethereum-beacon-chain-blockchain-reorg

If the protocol were to build on other chains, then reorg will happen more frequently:

https://protos.com/polygon-hit-by-157-block-reorg-despite-hard-fork-to-reduce-reorgs/

Impact

Attacker can steal sponsors funds in the event of a blockchain reorg.

Tools Used

Manual Review

Recommendations

Recommend sponsor only depositing the funds when nearing the contest completion date to prevent any form of reorg attacks. Alternatively, funds can be sent to the proxy factory first for safekeeping, before rerouting to the proxy at a later date.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.