OrderBook
First Flight #43
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Impact: medium
Likelihood: high
Invalid

Emergency withdraw for non constructor initialized core tokens

xgrybto

Description

  • This issue allows the owner to withdraw core tokens that are added to the contract after the initialization of itself. This should not be possible refering to the documentation.

  • The function emergencyWithdrawERC20 should enable the possibility to withdraw all non-core tokens, so all tokens that are not used to create orders in the orderbook

  • The verification of core tokens is hardcoded inside the function only for tokens that are allowed at the initialization state of the contract : WSOL, WBTC, WETH, USDC

  • A token that is added through the setAllowedSellToken is not verified and can be withdrawn with the emergency function

function emergencyWithdrawERC20(
address _tokenAddress,
uint256 _amount,
address _to
) external onlyOwner {
if (
_tokenAddress == address(iWETH) ||
_tokenAddress == address(iWBTC) ||
_tokenAddress == address(iWSOL) ||
_tokenAddress == address(iUSDC)
) {
revert(
"Cannot withdraw core order book tokens via emergency function"
);
...

Risk

Likelihood:

  • if a token is added to the core tokens

Impact:

  • the owner can withdraw added core token

Proof of Concept

function test_emergencyCoreTokenAdded() public {
MockWATOM watom = new MockWATOM(18);
watom.mint(address(book), 1e18);
vm.startPrank(owner);
// Add WATOM as core token
book.setAllowedSellToken(address(watom), true);
// Emergency withdrawing WATOM
book.emergencyWithdrawERC20(address(watom), 1e18, owner);
vm.stopPrank();
// The transaction is successful
assert(watom.balanceOf(owner) == 1e18);
}

Recommended Mitigation

We can verify the allowedSellToken mapping variable instead.

function emergencyWithdrawERC20(
address _tokenAddress,
uint256 _amount,
address _to
) external onlyOwner {
if (!allowedSellToken[_tokenAddress] || _tokenAddress == address(iUSDC)) {
revert(
"Cannot withdraw core order book tokens via emergency function"
);
}
...
​
Updates

Lead Judging Commences

yeahchibyke Lead Judge
about 2 months ago
yeahchibyke Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Appeal created

xgrybto Submitter
about 1 month ago
yeahchibyke Lead Judge
about 1 month ago
yeahchibyke Lead Judge about 1 month ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.