Submitted by VAD37, also found by thank_you (1, 2, 3), santiellena, ArsenLupin, jesusrod15, and ayden
In V3Vault.sol there all 3 instances of permit2.permitTransferFrom(), all 3 does not check token transfered in is USDC token.
Allowing user to craft permit signature from any ERC20 token and Vault will accept it as USDC.
User can steal all USDC from vault using permit signature of any ERC20 token.
Here is how Vault accept USDC from user. Vault will accept Uniswap.Permit2 signature transfer allowance from Permit2 then to vault contract.
https://github.com/code-423n4/2024-03-revert-lend/blob/435b054f9ad2404173f36f0f74a5096c894b12b7/src/V3Vault.sol#L877C1-L917C6
Below is permit signature struct that can be decoded from user provided data:
V3Vault.sol needs to check TokenPermissions.token is USDC, same as vault main asset.
Uniswap.permit2.permitTransferFrom() only checks if the sign signature is correct. This is meaningless as Vault does not validate input data.
This allows users to use any ERC20 token, gives allowance and permits to Uniswap.Permit2. The Vault will accept any transfer token from Permit2 as USDC. Allowing users to deposit any ERC20 token and steal USDC from vault.
Fix missing user input validations in 3 all instances of permit2:
https://github.com/code-423n4/2024-03-revert-lend/blob/main/src/V3Vault.sol#L717C1-L725C15
https://github.com/code-423n4/2024-03-revert-lend/blob/main/src/V3Vault.sol#L893C1-L898C15
https://github.com/code-423n4/2024-03-revert-lend/blob/main/src/V3Vault.sol#L877C1-L917C6
ERC20
kalinbas (Revert) confirmed
Revert mitigated:
Status: Mitigation confirmed. Full details in reports from thank_you, b0g0 and ktg.
