Submission Details
Severity:
[M-2] Centralized Keeper Privilege Enables Fund Theft in CreditDelegationBranch
Summary
System keepers can arbitrarily call settleVaultsDebt and rebalanceVaultsAssets to manipulate collateral flows.
Vulnerability Details
Attack Path:
Malicious keeper calls
settleVaultsDebtwith manipulated swap parametersRoutes vault assets to attacker-controlled addresses
Proof of Concept:
function testMaliciousKeeper() public {
// Keeper approves malicious dex adapter
vm.prank(KEEPER);
creditDelegation.setDexAdapter(MALICIOUS_ADAPTER);
// Settle debt using rigged swaps
vm.prank(KEEPER);
creditDelegation.settleVaultsDebt(VAULT_ID); // Sends 90% to attacker
}
Impact
Full Drain Possible: If keeper keys compromised
Low Difficulty: Single transaction exploit
Tools Used
Access control analysis
Privilege escalation scenarios
Recommendations
// 1. Multi-sig for keeper operations
// 2. On-chain swap validation
require(swapPrice >= oraclePrice * 99 / 100, "Price manipulation");
Prize pool breakdown
Total prize
70,000 USDC
nSLOC
3,25821 USDC / LOC
66,500
3,500
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.