First Flight #21: KittyFi

Summary

The function KittyPool::purrgeBadPawsition lacks proper access control, allowing malicious actors to exploit the function to purge any user's bad position and withdraw funds, including the amount to be distributed and an additional reward.

Vulnerability Details

The purrgeBadPawsition function can be called by any user without restriction, which poses a significant security risk. This function is intended to purge a user's bad position by burning their debt and redistributing their collateral. However, due to the absence of access control, any user can call this function on behalf of another user. As a result, an attacker can arbitrarily select a target, purge their bad position, and withdraw the collateral intended for redistribution, plus an extra reward.

The vulnerable code is as follows:

Impact

• Stolen Funds: An attacker could steal funds from other users by purging their positions and claiming the distributed collateral and rewards.

• Loss of User Trust: The ability for unauthorized users to tamper with other users' positions could severely damage trust in the platform.

• Potential Financial Loss: Users may experience financial losses due to unauthorized purges of their positions, leading to a loss of collateral.

Tools Used

• Manual review

Recommendations

• Implement Access Control: Use appropriate modifiers or access control mechanisms to ensure that only authorized roles (e.g., an administrator or the affected user) can call the purrgeBadPawsition function.

• Restrict Withdrawals: Ensure that withdrawals of collateral and rewards can only be executed under strict, predefined conditions and by authorized users.