Submitted by serial-coder, also found by Arz, rbserver, 0xmystery, deth, xeros, 0xpiken, rvierdiiev, DanielArmstrong, Shubham, 0x70C9, and 0xAlix2
The LendingTermOffboarding contract allows guild holders to poll to remove a lending term. If the voting weight is enough, the lending term can be offboarded without delay. Further, the offboarded term can be re-onboarded to become an active term through the LendingTermOnboarding::proposeOnboard() following up with the voting mechanism.
The following briefly describes the steps for offboarding the lending term through the LendingTermOffboarding contract:
The following roughly describes the steps for re-onboarding the offboarded lending term through the LendingTermOnboarding contract:
This report describes the vulnerability in the LendingTermOffboarding contract, allowing an attacker to force the re-onboarded lending term to offboard by overriding the DAO vote offboarding mechanism. In other words, the attacker is not required to create an offboarding poll and wait for the vote to succeed in offboarding the target term.
The following explains the attack steps:
After successfully re-triggering the canOffboard[term] flag in step 2, the attacker can suddenly offboard the target re-onboarded term whenever they will, regardless of how long the target term has been re-onboarded, how long the offboarding poll has expired, or how long the canOffboard[term] flag has been re-triggered (please refer to the Proof of Concept section for the coded PoC).
@1 - After all offboarded term's loans have been closed, the cleanup() can be executed to explicitly clean up the term and reset the canOffboard[term] flag: See here.
@2 - The lending term offboarding poll has an age of ~7 days: See here.
@3 - Attacker can cast a vote to re-trigger the canOffboard[term] flag: See here.
@4 - Attacker can force offboarding the re-onboarded term, overriding the DAO vote offboarding mechanism: See here.
The active re-onboarded lending term can be forced to immediately offboard, bypassing the DAO vote offboarding, which is the protocols core mechanism. Subsequently, the attacked lending term will block all new loans from being issued and prevent guild holders from voting for the term.
Moreover, all loans previously issued by the attacked term can be called putting the loans for bidding silently (since the attacker bypasses the DAO vote offboarding mechanism). If one of the loans fails on bidding to fill up the loans principal, the terms loss will be notified. As a result, all users who stake credit tokens through the SurplusGuildMinter contract to vote for the attacked term will be slashed with all their credit principal and guild rewards.
Place the testPoCBreakingDaoVoteOffboarding() in the .test/unit/governance/LendingTermOffboarding.t.sol file and run the test using the forge test --match-test testPoCBreakingDaoVoteOffboarding -vvv command:
Implement a proper mechanism for preventing the (active) lending term offboarding poll from re-triggering the canOffboard[term] flag, or deprecating the poll from further voting if the associated lending term has been cleaned up (via the cleanup()).
eswak (Ethereum Credit Guild) confirmed, but disagreed with severity and commented:
TrungOre (judge) decreased severity to Medium and commented:
serial-coder (warden) commented:
TrungOre (judge) commented:
Note: For full discussion, see here.
