Submitted by bin2chen
https://github.com/code-423n4/2023-01-astaria/blob/1bfc58b42109b839528ab1c21dc9803d663df898/src/LienToken.sol#L366-L368
Corrupt multiple key properties of public vault, causing vault not to function properly.
When LienToken.makePayment()/buyoutLien()/payDebtViaClearingHouse()
If it corresponds to PublicVault, it will make multiple changes to the vault, such as: yIntercept, slope, last, epochData, etc.
If LienToken corresponds to PublicVault, then ownerOf(lienId) = PublicVault address
When the LienToken is a private vault, it is possible to transfer the owner of the LienToken.
As the above seems, if the private vault is transferred to the PublicVault address will result in the wrong modification of the yIntercept, slope, last, epochData, etc.
So we restrict the to in transferFrom to not be a PublicVault address
However, such a restriction does not prevent an attacker from transferring PrivateVaults LienToken to PublicVault.
Because the address is predictable when the vault contract is created, a malicious user can predict the vault address, front-run, and transfer PrivateVaults LienToken to the predicted PublicVault address before the public vault is created, thus bypassing this restriction
Assumptions:
Note: newPublicVAult() although the use of create(), but still can predict the address
seehttps://ethereum.stackexchange.com/questions/760/how-is-the-address-of-an-ethereum-contract-computed
The corresponding vault address is stored in s.lienMeta[id].orginOwner when the LienToken is created, this is not modified. Get the vault address from this variable, not from ownerOf(id).
androolloyd (Astaria) confirmed
