#37671 [SC-Critical] CRITICAL-02 / The contract could be permanently locked due to not reseting the boolen lock
Submitted on Dec 12th 2024 at 09:40:40 UTC by @Minato7namikazi for IOP | Fluid Protocol
Report ID: #37671
Report Type: Smart Contract
Report severity: Critical
Target: https://github.com/Hydrogen-Labs/fluid-protocol/tree/main/contracts/trove-manager-contract/src/main.sw
Impacts:
Protocol insolvency
Description
In the trove-manager-contract/src/main.sw
There is a path in "internal_redeem_collateral_from_trove" function that leads to an early return statement without resetting the reentrancy lock.
This causes the contract to remain permanently locked, effectively freezing the redemption functionality
Details & Impact
The function internal_redeem_collateral_from_trove
uses a storage boolean ( lock_internal_redeem_collateral_from_trove ) to prevent reentrancy attacks. The intended pattern is:
At the start of the function, set the lock to
true
.Execute the redemption logic.
At the end of the function, set the lock back to
false
.
This ensures that if the function reverts or completes normally, the lock is reset, and subsequent calls are not blocked.
within this function, there is a conditional branch that can cause an early return before reaching the lock reset :
In this scenario, if new_debt < MIN_NET_DEBT
, the function returns early
never reaching the code that set storage.lock_internal_redeem_collateral_from_trove
back to false
As a result, the lock remains permanently engaged. Once locked, no subsequent calls that require this lock to be false
can proceed, effectively breaking the redemption functionality
Causing a Critical Protocol insolvency
PoC in "trove-manager-contract/tests/failure.rs"