DittoETH

Vulnerability Details

The DittoEth protocol allows for the shutdown of a market through the MarketShutdownFacet::shutdownMarket() function. When a market is shutdown, its asset (initially cUSD) is marked as permanently frozen through the isPermanentlyFrozen() modifier. However, the VaultFacet::withdrawAsset() function currently lacks a check for whether the asset is permanently frozen.

As per the intended design, after a market is shutdown, the asset should only be able to be withdrawn through the MarketShutdownFacet::redeemErc() function, which changes the user asset balance from ercEscrowed to ethEscrowed. However, the VaultFacet::withdrawAsset() function can still be called even when the asset is permanently frozen, contradicting the expected behavior and exposing the protocol to potential abuse.

Impact

Unauthorized Asset Withdrawal: Users or malicious actors can exploit this vulnerability to withdraw assets (cUSD) from a frozen market, potentially destabilizing the protocol.

Recommendations

Add a check for permanently frozen assets: Modify the VaultFacet::withdrawAsset() function to include the check isNotFrozen(asset) and prevent withdrawals when the asset is frozen.