stake.link

Summary :

During the analysis of the SDLPool smart contract, a critical vulnerability related to reentrancy was identified. This vulnerability allows an attacker to initiate unauthorised fund withdrawals, potentially resulting in financial losses and disruption of the contract's intended functionality. I also attached example Github link for this vulnerability.

Vulnerability Details :

The vulnerability is present in the withdraw function of the SDLPool.sol contract. The contract lacks proper checks to prevent reentrancy attacks, allowing an attacker to repeatedly call the withdraw function and drain funds from the contract.

The impact of this vulnerability includes:

1. Unauthorized fund withdrawals

2. Potential disruption of contract functionality

3. Financial losses for contract users

Steps to Reproduce:

1. Deploy the SDLPool.sol contract.

2. Stake a certain amount of SDL tokens using the onTokenTransfer function.

3. Exploit the reentrancy vulnerability by repeatedly calling the withdraw function.

Proof of concept :

 function withdraw(uint256 _lockId, uint256 _amount)
external
onlyLockOwner(_lockId, msg.sender)
updateRewards(msg.sender)
  {
// ... (omitted for brevity)
sdlToken.safeTransfer(msg.sender, _amount);
// ... (omitted for brevity)
   }

Below is a simplified proof of concept in pseudocode:

 // Malicious contract
     contract MaliciousContract {
        SDLPool vulnerableContract;

       constructor(SDLPool _vulnerableContract) {
         vulnerableContract = _vulnerableContract;
       }

          // Reentrant function
         function attack(uint256 _lockId, uint256 _amount) external {
             // Call the vulnerable withdraw function, initiating the attack
            vulnerableContract.withdraw(_lockId, _amount);
              
           // Additional malicious logic can be executed here
         }
        }

Expected Result :

Unauthorised withdrawals occur, and the contract's funds are drained.

Tools Used :

The analysis is based on manual code review and does not involve specific automated testing tools in this context.

Recommended Mitigation Steps :

1. Implement reentrancy protection mechanisms, such as using the ReentrancyGuard contract from OpenZeppelin.

2. Ensure that critical state changes are performed before any external calls to prevent potential reentrancy attacks.

Conclusion :

The identified vulnerability poses a significant risk to the security and functionality of the SDLPool.sol contract. Urgent action is recommended to implement the suggested mitigation steps and secure the contract against potential exploitation.