Submitted by Neon2835, also found by MohammedRizwan, Arz, DedOhWale, 0xcm, 0xRobocop, azhar, HE1M, zaevlad, and kankodu
https://github.com/code-423n4/2023-06-lybra/blob/7b73ef2fbb542b569e182d9abf79be643ca883ee/contracts/lybra/token/PeUSDMainnetStableVision.sol#L129-L139
https://github.com/code-423n4/2023-06-lybra/blob/7b73ef2fbb542b569e182d9abf79be643ca883ee/contracts/lybra/token/EUSD.sol#L228-L230
The executeFlashloan function of the PeUSDMainnet contract is used to provide users with the flash loan function. There is a loophole in the logic and hackers can use this loophole to burn other peoples eUSD token balance without permission.
Since the parameter FlashBorrower receiver of the executeFlashloan function can be designated as anyone, the flash loan system will charge a certain percentage of the loan fee (up to 10%) to receiver for each flash loan. The code is as follows:
When a hacker maliciously initiates a flash loan for a receiver contract, and the value of the eusdAmount parameter passed in is large enough, the receiver will be deducted a large amount of loan fees; the hacker can burn a large amount of other peoples eUSD without permissioning the amount.
Let us analyze the design logic of the system itself step by step for discussion:
The above code indicates that the miner of EUSD can call transferFrom arbitrarily, without the user calling increaseAllowance for approval. The PeUSDMainnet contract is the minter of the EUSD contract, so line 133 of the PeUSDMainnet contract code:
bool success = EUSD.transferFrom(address(receiver), address(this), EUSD.getMintedEUSDByShares(shareAmount)); can be executed without user approval.
The following is the forge test situation I simulated locally:
The fallback function of the GnosisSafeProxy contract is allowed to be called without revert.
Visual Studio Code
Foundry
Optimize the flash loan logic of the executeFlashloan function of the PeUSDMainnet contract, remove the FlashBorrower receiver parameter, and set receiver to msg.sender; which means that a user can only initiate a flash loan for themselves.
LybraFinance confirmed
