Skip to content

Latest commit

 

History

History
59 lines (37 loc) · 2.23 KB

039.md

File metadata and controls

59 lines (37 loc) · 2.23 KB

Fit Menthol Sawfish

Medium

The first expansion in GoodDollarExpansionController::mintUBIFromExpansion() may be called instantly

Summary

GoodDollarExpansionController::mintUBIFromExpansion() is supposed to be called every config.expansionFrequency, but in the initial expansion it may be called right away without passing this time.

Root Cause

In GoodDollarExpansionController:177, it allows expanding if the config.lastExpansion is 0.

Internal pre-conditions

None.

External pre-conditions

None.

Attack Path

  1. Anyone may call GoodDollarExpansionController::mintUBIFromExpansion() as soon as the config is set and the exchange is created as opposed to waiting the expansionFrequency.

Impact

The protocol expands too soon instead of waiting the expansionFrequency.

PoC

GoodDollarExpansionController::mintUBIFromExpansion():

function mintUBIFromExpansion(bytes32 exchangeId) external returns (uint256 amountMinted) {
  IBancorExchangeProvider.PoolExchange memory exchange = IBancorExchangeProvider(address(goodDollarExchangeProvider))
    .getPoolExchange(exchangeId);
  ExchangeExpansionConfig memory config = getExpansionConfig(exchangeId);

  bool shouldExpand = block.timestamp > config.lastExpansion + config.expansionFrequency;
  if (shouldExpand || config.lastExpansion == 0) {
    uint256 reserveRatioScalar = _getReserveRatioScalar(config);

    exchangeExpansionConfigs[exchangeId].lastExpansion = uint32(block.timestamp);
    amountMinted = goodDollarExchangeProvider.mintFromExpansion(exchangeId, reserveRatioScalar);

    IGoodDollar(exchange.tokenAddress).mint(address(distributionHelper), amountMinted);
    distributionHelper.onDistribution(amountMinted);

    // Ignored, because contracts only interacts with trusted contracts and tokens
    // slither-disable-next-line reentrancy-events
    emit ExpansionUBIMinted(exchangeId, amountMinted);
  }
}

Mitigation

Set config.lastExpansion when setting the config to block.timestamp and remove config.lastExpansion == 0 from the if condition that decides if the exchange should be expanded.