Submission Details
Severity:
Potential Re-org Attack Vector
Summary
The contract appears to deploy new contracts using the new keyword.
Vulnerability Details
In a re-org attack scenario, such deployments can be exploited by a malicious actor who might deploy the contract at an expected address.
File: contracts/LiquidationPoolManager.sol
23: pool = address(new LiquidationPool(_TST, _EUROs, _eurUsd, ISmartVaultManager(_smartVaultManager).tokenManager()));
Tools Used
VSCode
Recommendations
Consider deploying the contract via CREATE2 opcode with a specific salt that includes msg.sender and the existing contract address.
This will ensure a predictable contract address, reducing the chances of such an attack.
Updates
Lead Judging Commences
hrishibhat over 1 year ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
informational/invalid
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
60933 USDC / LOC
17,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.