Sparkn

CodeFox Inc.
DeFiFoundryProxy
15,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Improper validation of ` implementation`

tripathi

Summary

Admin creates new contest with organizer, contestId, closeTime and implementation. implementation is an contract address of distributor contract but can be passed as an EOA or address which don't have code, to create a contest

Vulnerability Details

As explained in Summary an EOA address can be passed as implementation address which will emit an setContest

File: src/ProxyFactory.sol
​
105 emit SetContest(organizer, contestId, closeTime, implementation);
​

https://github.com/Cyfrin/2023-08-sparkn/blob/main/src/ProxyFactory.sol#L116

This event is an indicator to sponsors their interest of contest has been created and they will start investing by computing pre deployed address.

But all the delegate call to this implementation address will fail and funds will be locked in contract.

This problem arises majorly when Deployer deploy contract using CREATE2 opcode and doesn't do proper validation of contract deployed. So it will be best to do proper validation of implementation address
A eg Reference - https://solodit.xyz/issues/m-13-improper-validation-of-create2-return-value-code4rena-mochi-mochi-contest-git

File: src/Proxy.sol
​
fallback() external {
address implementation = _implementation;
assembly {
let ptr := mload(0x40)
calldatacopy(ptr, 0, calldatasize())
let result := delegatecall(gas(), implementation, ptr, calldatasize(), 0, 0)
let size := returndatasize()
returndatacopy(ptr, 0, size)
​
switch result
case 0 { revert(ptr, size) }
default { return(ptr, size) }
}
}

https://github.com/Cyfrin/2023-08-sparkn/blob/main/src/Proxy.sol#L51C4-L64C6

Impact

Impact is critical as loss of all the funds sent to proxyContract but likelihood is not high so marking as medium

Tools Used

Manual

Recommendations

check for extcodesize(implementAddress) during setting a contest and revert if it is zero.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!