Active Boosts

25886 - [SC - Insight] registerToken can be front-run causing token ca...

Submitted on Nov 20th 2023 at 22:35:43 UTC by @yttriumzz for Boost | DeGate

Report ID: #25886

Report type: Smart Contract

Report severity: Insight

Target: https://etherscan.io/address/0x9C07A72177c5A05410cA338823e790876E79D73B#code

Impacts:

  • Griefing (e.g. no profit motive for an attacker, but damage to the users or the protocol)

Description

    function registerToken(
        ExchangeData.State storage S,
        address tokenAddress,
        bool isOwnerRegister
        )
        public
        returns (uint32 tokenID)
    {
        require(!S.isInWithdrawalMode(), "INVALID_MODE");
        require(S.tokenToTokenId[tokenAddress] == 0, "TOKEN_ALREADY_EXIST");

        if (isOwnerRegister) {
            require(S.reservedTokens.length < ExchangeData.MAX_NUM_RESERVED_TOKENS, "TOKEN_REGISTRY_FULL");
        } else {
            require(S.normalTokens.length < ExchangeData.MAX_NUM_NORMAL_TOKENS, "TOKEN_REGISTRY_FULL");
        }

        // Check if the deposit contract supports the new token
        if (S.depositContract != IDepositContract(0)) {
            require(S.depositContract.isTokenSupported(tokenAddress), "UNSUPPORTED_TOKEN");
        }

        // Assign a tokenID and store the token
        ExchangeData.Token memory token = ExchangeData.Token(tokenAddress);

        if (isOwnerRegister) {
            tokenID = uint32(S.reservedTokens.length);
            S.reservedTokens.push(token);
        } else {
            tokenID = uint32(S.normalTokens.length.add(ExchangeData.MAX_NUM_RESERVED_TOKENS));
            S.normalTokens.push(token);
        }
        S.tokenToTokenId[tokenAddress] = tokenID + 1;
        S.tokenIdToToken[tokenID] = tokenAddress;

        S.tokenIdToDepositBalance[tokenID] = 0;

        emit TokenRegistered(tokenAddress, tokenID);
    }

Everyone can call registerToken to register a token. If it is called by the owner, the token is added to reservedTokens, otherwise it is added to normalTokens. Once a token is added to reservedTokens or normalTokens, it cannot be added again.

Therefore, the attacker can add the token that the Owner expects to be added to reservedTokens to normalTokens first.

The attack process is as follows:

  1. Owner call registerToken to register TokenA

  2. The attacker observes that mempool recognizes the Owner's transaction, initiates a transaction with a higher gas price, and front-run executes registerToken to register TokenA.

Impact

https://docs.degate.com/v/product_en/concepts/economic-security

Please refer to the above document for the difference between reservedTokens and normalTokens. The owner's inability to add tokens to reservedTokens may damage the stable run of the protocol.

Risk Breakdown

Difficulty to Exploit: Easy

Recommendation

Owner can convert normalTokens into reservedTokens, which can prevent this BUG. And it allows the Owner to have the ability to add reservedTokens in the future. (For example, if a Token becomes popular, consider upgrading it from normalTokens to reservedTokens).

References

Proof of concept

Output:

Previous25885 - [SC - Insight] Prevent the operator from submitting blocks to LNext25892 - [SC - Insight] A malicious user can DoS force withdraw request...

Last updated

Was this helpful?