Submitted by xiaoming90, also found by berndartmueller
When users withdraw their strike escrowed in Putty contract, Putty will charge a certain amount of fee from the strike amount. The fee will first be sent to the contract owner, and the remaining strike amount will then be sent to the users.
https://github.com/code-423n4/2022-06-putty/blob/3b6b844bc39e897bd0bbb69897f2deff12dc3893/contracts/src/PuttyV2.sol#L500
There are two methods on how the owner can deny user from withdrawing their strike amount from the contract
Many of the token implementations do not allow transfer to zero address (Reference). Popular ERC20 implementations such as the following Openzeppelins ERC20 implementation do not allow transfer to zero address, and will revert immediately if the to address (recipient) points to a zero address during a transfer.
https://github.com/OpenZeppelin/openzeppelin-contracts/blob/5fbf494511fd522b931f7f92e2df87d671ea8b0b/contracts/token/ERC20/ERC20.sol#L226
It is possible for the owner to transfer the ownership to a zero address, thus causing the fee transfer to the contract owner to always revert. When the fee transfer always reverts, no one can withdraw their strike amount from the contract.
This issue will affect all orders that adopt a baseAsset that reverts when transferring to zero address.
ERC777 contains a tokensReceived hook that will notify the recipient whenever someone sends some tokens to the recipient .
Assuming that the baseAsset is a ERC77 token, the recipient, which is the owner() in this case, could always revert whenever PuttyV2 contract attempts to send the fee to recipient. This will cause the withdraw function to revert too. As a result, no one can withdraw their strike amount from the contract.
This issue will affect all orders that has ERC777 token as its baseAsset.
User cannot withdraw their strike amount and their asset will be stuck in the contract.
It is recommended to adopt a withdrawal pattern for retrieving owner fee.
Instead of transferring the fee directly to owner address during withdrawal, save the amount of fee that the owner is entitled to in a state variable. Then, implement a new function that allows the owner to withdraw the fee from the PuttyV2 contract.
Consider the following implementation. In the following example, there is no way for the owner to perform denial-of-user because the outcome of the fee transfer (succeed or fail) to the owner will not affect the users strike withdrawal process.
This will give users more assurance and confidence about the security of their funds stored within Putty.
outdoteth (Putty Finance) disagreed with severity
HickupHH3 (judge) commented:
HickupHH3 (judge) decreased severity to Medium and commented:
outdoteth (Putty Finance) confirmed and resolved:
hyh (warden) reviewed mitigation:
