011.md

Bumpy Silver Albatross

Medium

Missing check of uniqness of exchange id

Summary

In BanchorExchangeProvider.sol:_createExchange we're generating exchangeId as encodePacked of symbols of reserveAssets and tokenAddress. Since .symbol for tokens shouldn`t be unique in ETH ecosystem we might got id which will collide with another one.

Root Cause

BanchorExchangeProvider.sol:_createExchange

Internal pre-conditions

since it is private function it requires some activity from admin, however, calling this function with such tokens, where the symbols are identical to the symbols from another pool, is a normal functioning of the protocol, and accordingly, does not imply that the admin has violated any rules or has been deceived

External pre-conditions

Admin has to add exchange with tokens which have same symbols as an already existing exchange

Attack Path

No response

Impact

Protocol will re-write (DELETE) existing exchange struct with all data and add new one on it's place bcs it

exchanges[exchangeId] = exchange;

It will make a lot of confusion across the protocol since it is crucial struct.

PoC

No response

Mitigation

add check for exchangeId uniqueness inside BanchorExchangeProvider.sol:_createExchange