Oblivionis - Perennial account users with rebalance group may suffer a donation attack #84
Labels
Sponsor Confirmed
The sponsor acknowledged this issue is valid
Will Fix
The sponsor confirmed this issue will be fixed
Oblivionis
High
Perennial account users with rebalance group may suffer a donation attack
Summary
The checks in
checkMarket
only consider proportions and not values, users with 0 collateral in a rebalance group may get attacked to drain all DSU in their perennial accounts.Root Cause
This vulnerability has two predicate facts:
InvariantLib.sol:78-82
Users can sign an order if: 1. He is an signer or 2. He is an operator or 3. He is trying to deposit some value to the account without position change.
Controller.sol:223
Controller.sol:92
RebalanceLib.sol:18
In
Controller.checkGroup()
:groupCollateral
= 1e-6,actualCollateral
= 1e-6 for one market, = 0 for other markets.After passed into
RebalanceLib
, for all markets,targetCollateral = groupCollateral.mul(Fixed6Lib.from(marketConfig.target));
Since
marketConfig.target < Fixed6.ONE
(It is the percentage of a single market), targetCollateral will be less than the precision of Fixed6, so it round down to 0.For the market with collateral,
targetCollateral
= 0 butmarketCollateral
= 1e-6.So
pctFromTarget
= 1 - 0/1e-6 = 1 = 100%.So
canRebalance
= pctFromTarget.abs().gt(marketConfig.threshold) = 1.For the market without collateral,
targetCollateral
= 0 andmarketCollateral
= 0.canRebalance
= 0 but it does not matter.Now we have proven such group can always get rebalanced. Next we will show that each
rebalance
does not change the market allocation:imbalance = targetCollateral.sub(marketCollateral);
For the market with collateral, imbalance = 0- 1e-6 = -1e-6.
For markets without collateral, imbalance = 0 - 0 = 0.
When
Controller
tries to perform the market transfer, the 1e-6 collateral will be transfered back to victim`s perennial account. Now we reached the initial state: all markets in the group have no fund in it.Internal pre-conditions
a. The owner withdraw from all these markets.
b. The owner was liquidated in these markets and no margin left. (This is possible due to high leverage).
c. The owner just activated the group and haven't had a chance to put money in it yet.
External pre-conditions
N/A
Attack Path
Controller_Incentivized.rebalanceGroup()
to perform the attack and resume group state.Impact
Victim's account balance can get drained when they have an empty group.
PoC
No response
Mitigation
There should be a minimum rebalance value check to prevent this issue and prevent users pay more keeper fee than the rebalanced margin when margin is tiny.
The text was updated successfully, but these errors were encountered: