Submitted by serial-coder, also found by EV_om, 0xStalin, evmboi32, Soul22, DanielArmstrong, gesha17, SpicyMeatball, smiling_heretic, nonseodion, Cosine, HighDuty, 0xbepresent, lsaudit, kaden, and ether_sky
The LendingTermOffboarding contract allows guild holders to poll to remove a lending term. If the voting weight is enough, the lending term can be offboarded without delay. Further, the offboarded term can be re-onboarded to become an active term through the LendingTermOnboarding::proposeOnboard() following up with the voting mechanism.
The following briefly describes the steps for offboarding the lending term through the LendingTermOffboarding contract:
The following roughly describes the steps for re-onboarding the offboarded lending term through the LendingTermOnboarding contract:
This report describes the vulnerability in the LendingTermOffboarding contract, allowing an attacker to force the re-onboarded lending term to offboard by overriding the DAO vote offboarding mechanism. In other words, the attacker is not required to create an offboarding poll and wait for the vote to succeed in offboarding the target term. Furthermore, the attacker is not required to possess any guild tokens.
The following explains the attack steps:
The attacker can suddenly offboard the re-onboarded term whenever they will, regardless of how long the target term has been re-onboarded, how long the offboarding poll has expired, or how long the canOffboard[term] flag has been activated (please refer to the Proof of Concept section for the coded PoC).
Furthermore, the attacker does not need to hold guild tokens to exploit this vulnerability:
@1 - Once the voting weight is enough, the canOffboard[term] flag will be set: See here.
@2 - If the canOffboard[term] flag is set, the term can be offboarded: See here.
@3 - To clean up the term, all its loans must be closed: See here.
The active re-onboarded lending term can be forced to immediately offboard, bypassing the DAO vote offboarding, which is the protocols core mechanism. Subsequently, the attacked lending term will block all new loans from being issued and prevent guild holders from voting for the term.
Moreover, all loans previously issued by the attacked term can be called putting the loans for bidding silently (since the attacker bypasses the DAO vote offboarding mechanism). If one of the loans fails on bidding to fill up the loans principal, the terms loss will be notified. As a result, all users who stake credit tokens through the SurplusGuildMinter contract to vote for the attacked term will be slashed with all their credit principal and guild rewards.
Place the testPoCReplayOffboarding() in the .test/unit/governance/LendingTermOffboarding.t.sol file and run the test using the forge test --match-test testPoCReplayOffboarding -vvv command:
Implement a proper mechanism for resetting the canOffboard[term] flag once the associated lending term has been re-onboarded.
It is worth noting that the canOffboard[term] flag should be reset after the term re-onboarding operation has successfully been executed by Timelock (when the term is already active) to prevent other security issues.
eswak (Ethereum Credit Guild) confirmed, but disagreed with severity and commented:
TrungOre (judge) decreased severity to Medium
serial-coder (warden) commented:
TrungOre (judge) commented:
Note: For full discussion, see here.
