Submitted by sin1st3r__, also found by jasonxiale, evmboi32, JCN, 0xA5DF, KupiaSec, Jorgect, said, J4X, and kaden
The vulnerability exists in the Guard.sol contract, L-242
The guard does not differentiate between ERC1155 tokens of address of same ID that are actively being rented and those that arent rented. So for example, you had 2,000 GameToken ERC1155 tokens with an id of 5, that are not rented. And you rented 10 GameToken ERC1155 tokens of the same id 5, you will not be able to move or transfer the non-rented 2,000 GameToken ERC1155 tokens which you had prior to rented the other 10 tokens, until the 10 GameToken rental expires and gets stopped/finalized.
The problem is that a malicious lender can exploit this to freeze the borrowers pre-existing funds of the same kind indefinitely by preventing his rental (the rental in which the lender lended ERC1155 tokens to the borrower), from being stopped even if the expiry date of the rental has passed. He can do so by utilizing the fact that the Reclaimer contract utilizes safeTransferFrom to give the lender his tokens back after the rental gets stopped. The lender can then set up a onERC1155Receive() hook that reverts until he decides otherwise. This will prevent the rental from being stopped and therefore, itll prevent the borrower from transferring his pre-rental tokens, making them indefinitely stuck.
Proof of concept
To run the PoC, youll need to do the following:
Note: All of my 7 PoCs throughout my reports include the SetupExploit.sol. Please do not rely on the previous SetupExploit.sol file if you already had one from another PoC run in the tests/ folder. In some PoCs, there are slight modifications done in that file to properly set up the test infrastructure needed for the exploit
The files:
Allows a malicious lender to indefinitely freeze borrowers assets.
The guard needs to differentiate between ERC1155 tokens of same type and ID that are rented and those that are not actively rented. This can be done by implementing a mapping which keeps track of the amount of ERC1155 tokens that become rented and this mapping can then be utilized by the guard to determine whether or not it should let the transferral of the ERC1155 tokens pass.
Alec1017 (reNFT) confirmed
Note: To see full discussion, see here.
reNFT mitigated:
Status: Mitigation confirmed. Full details in reports from juancito, EV_om and sin1st3r__.
