The Standard

Summary

A vulnerability exists in the LiquidithPool.increasePosition function, which permits a malicious user to repeatedly create positions with minimal value. This leads to a bloated LiquidithPool.pendingStakes array, potentially causing a Denial of Service on the LiquidithPool contract and impairing its core functions.

Vulnerability Details

The increasePosition function in the liquidationPool contract allows for the deposit of EUROs or TST tokens. Users must wait one day for their stake to be consolidated. The functions increasePosition and decreasePosition invoke consolidatePendingStakes, an expensive operation due to multiple storage read/write processes.

The increasePosition process does not check or limit the amount of the new position. This oversight allows a malicious user to indefinitely create pending stakes with trivial amounts (as little as 1 wei), potentially causing an out-of-gas exception for any function interacting with the pendingStakes array.

A simple Proof of Concept demonstrates how a malicious user can flood the pendingStakes array with numerous low-valued stakes.

Impact

The LiquidithPool contract is integral to the protocol, especially in the liquidation process. The DOS vulnerability has several significant impacts:

1. consolidatePendingStakes becomes inoperable, affecting increasePosition, decreasePosition, and distributeAssets.

2. decreasePosition, distributeAssets, and distributeFees also become inoperable, trapping tokens in the liquidationPool.

3. The inoperability of distributeFees and distributeAssets hinders the liquidation process.

The severity of this attack is high due to the potential for funds to be trapped in the contract. The likelihood of exploitation is also high, given the low cost of executing the attack.

Tools Used

Manual Review

Recommendations

Several mitigations can be implemented:

1. Enforce a minimum amount requirement for each deposit to prevent positions with very low values.

2. Aggregate positions from the same msg.sender to reduce the number of entries in the pendingStakes array.