Summary

This report addresses a significant security vulnerability in a smart contract system, which allows unauthorized users to manipulate market order data. The vulnerability arises from inadequate access controls and input validation in the update function.

Vulnerability Details

function update(Data storage self, uint128 marketId, int128 sizeDelta) internal {
self.marketId = marketId;
self.sizeDelta = sizeDelta;
self.timestamp = uint128(block.timestamp);
}

Lack of Access Control: The update function does not implement any mechanisms to restrict who can call it. This means any user can execute this function, potentially modifying market order data without proper authorization.

For example

The update function is intended to set or modify market orders, where marketId refers to a specific market, and sizeDelta represents the change in order size.

• Initial State:

• • Market ID: 1

  • Size Delta: 100 (indicating a buy order of 100 units)

  • Timestamp: The time when the order was created

• Now Unauthorized access

• Unauthorized User Action: An attacker who can call the update function without authorization inputs the following:

  • Market ID: 999 (an invalid or non-existent market)

  • Size Delta: -500 (a large negative value indicating a sell order)

Incorrect Market Data:

• Market ID: The attacker sets the market ID to 999, which may not exist in the system. This leads to inconsistencies where the system references a non-existent market.

• Size Delta: Setting a large negative sizeDelta could result in a substantial incorrect sell order being processed. This could affect trading operations and potentially lead to unintended trades or liquidations.

Here's a test example that demonstrates how an attacker could exploit the update function vulnerability:

Setup the Exploit Scenario

• The MarketOrder library has an update function that lacks access control.

• An unauthorized user will attempt to call update with arbitrary values.

  Writing the Exploit in Foundry

First, set up your environment. In your lib or contracts folder, you should have the MarketOrder library and its dependencies. Then, create a new test file in the test directory.

Unauthorized Update Test:

• The testUnauthorizedUpdate function simulates an unauthorized account attempting to update a market order.

• vm.prank(unauthorizedAddress) changes the msg.sender to unauthorizedAddress for the next call.

• The call to marketOrderData.update(2, 200) attempts to update the market order with new values

Impact

Financial Impact:

• Losses for Users: If the attacker is able to alter orders in a way that affects the market price or trading balances, users may suffer financial losses due to incorrect trades.

• Market Manipulation: By setting invalid or extreme values, the attacker could manipulate the market conditions, causing volatility and potentially exploiting price movements for profit

Operational Disruptions:

• Data Integrity Issues: Incorrect market IDs and order sizes can corrupt the contract's state, leading to errors in transaction processing and user balances.

Tools Used

Manual Review

Recommendations

Implement Proper Validation: Ensure that all inputs to the update function are validated according to the contract’s requirements.

For e.g we can add some validation checks in update functiom.

// Validation checks require(marketId > 0, "Invalid marketId");

require(sizeDelta != 0, "Invalid sizeDelta"); // Adjust as needed based on business rules

Use Access Control: Ensure that only authorized entities can call functions that modify the contract state.