Submitted by AkshaySrivastav
https://github.com/code-423n4/2023-01-ondo/blob/main/contracts/lending/tokens/cToken/CTokenModified.sol#L357-L379
https://github.com/code-423n4/2023-01-ondo/blob/main/contracts/lending/tokens/cToken/CTokenModified.sol#L506-L527
The CToken is a yield bearing asset which is minted when any user deposits some units of
underlying tokens. The amount of CTokens minted to a user is calculated based upon
the amount of underlying tokens user is depositing.
As per the implementation of CToken contract, there exists two cases for CToken amount calculation:
Here is the actual CToken code (extra code and comments clipped for better reading):
The above implementation contains a critical bug which can be exploited to steal funds of
initial depositors of a freshly deployed CToken contract.
As the exchange rate is dependent upon the ratio of CTokens totalSupply and underlying token
balance of CToken contract, the attacker can craft transactions to manipulate the exchange rate.
Steps to attack:
The same steps can be performed again to steal the next users deposit.
It should be noted that the attack can happen in two ways:
A sophisticated attack can impact all user deposits until the lending protocols owners and users are notified and contracts are paused. Since this attack is a replicable attack, it can be performed continuously to steal the deposits of all depositors that try to deposit into the CToken contract.
The loss amount will be the sum of all deposits done by users into the CToken multiplied by the underlying tokens price.
Suppose there are 10 users and each of them tries to deposit 1,000,000 underlying tokens into the CToken contract. Price of underlying token is $1.
Total loss (in $) = $10,000,000
New test case was added to forge-tests/lending/fToken/fDAI.t.sol
The fix to prevent this issue would be to enforce a minimum deposit that cannot be withdrawn. This can be done by minting a small amount of CToken units to 0x00 address on the first deposit.
Instead of a fixed 1000 value an admin controlled parameterized value can also be used to control the burn amount on a per CToken basis.
ali2251 (Ondo Finance) confirmed
ypatil12 (Ondo Finance) commented:
Trust (judge) commented:
