The Standard

Summary

Attacker can use the asset distribution mechanism in the Liquidation Pool to distribute a malicious asset.
This malicious asset will be exchanged against the EUROs position of stakers during distribution.

Vulnerability Details

The distributeAssets function in the Liquidation Pool takes several assets as input
and distributes them through the stakers by reducing their EUROs position.
As this function has no access control mechanism, an attacker is able to call it to distribute any
asset of his choice.

The attacker can call the function with his own ERC-20 token. Moreover, he can set his own
oracle to return arbitrary price. The Liquidation Pool will trust those inputs
and execute the asset distribution.

Impact

Attacker can burn the EUROs position of all the stakers.

Tools Used

Scope:

• https://github.com/Cyfrin/2023-12-the-standard/blob/main/contracts/LiquidationPool.sol#L205-L241

Proof of Concept - Exploit test

The following test can be included into the liquidationPoolManager.js files.
It shows that an attacker can burn the EUROs positions of all the stakers in the pool.

First, the attacker needs to create a malicious ERC20.
He needs to mint tokens to the LiquidationPoolManager and to set an approval between the LiquidationPoolManager and
the LiquidationPool. In the PoC, you can add a function to the ERC20Mock contract by applying the following diff:

Then, add the following test suite to liquidationPoolManager.js:

Recommendations

If distributeAssets should only be accessed by the Liquidation Pool Manager, add the onlyManager modifier.
The following fix show this case:

Line fixed: https://github.com/Cyfrin/2023-12-the-standard/blob/main/contracts/LiquidationPool.sol#L205