C-01 DoS Due to Unrestricted Growth of poolAssets Array #1889
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
sparrowDom
requested review from
DanielVF,
naddison36,
shahthepro,
smitch88 and
rafaelugolini
as code owners
rafaelugolini
temporarily deployed
to
preview-oeth-sparrowdom-xll8vu
rafaelugolini
temporarily deployed
to
preview-ousd-sparrowdom-ych3lp
sparrowDom
changed the base branch from
master
to
sparrowDom/balancer-composable-st-pool
Codecov Report
@@ Coverage Diff @@
## sparrowDom/balancer-composable-st-pool #1889 +/- ##
===========================================================================
- Coverage 67.58% 57.39% -10.19%
===========================================================================
Files 51 51
Lines 2724 2725 +1
Branches 703 704 +1
===========================================================================
- Hits 1841 1564 -277
- Misses 880 1158 +278
Partials 3 3
... and 7 files with indirect coverage changes 📣 Codecov offers a browser extension for seamless coverage viewing on GitHub. Try it in Chrome or Firefox today! |
shahthepro
approved these changes
Nov 2, 2023
sparrowDom
changed the title
DanielVF
reviewed
Nov 7, 2023
| @@ -174,6 +174,15 @@ describe("ForkTest: Balancer MetaStablePool rETH/WETH Strategy", function () { | |||
| auraRewardPool | |||
| ); | |||
| }); | |||
|
|
|||
| // Un-skip once we re-deploy the strategy | |||
| it.skip("Shouldn't be able to cache assets twice", async function () { | |||
There was a problem hiding this comment.
How are we going to make sure we do this?
There was a problem hiding this comment.
How about like this :)
74fd116
DanielVF
approved these changes
Nov 7, 2023
sparrowDom
force-pushed
the
sparrowDom/balancer-H01
branch
from
040cd1c
to
74fd116
Compare
sparrowDom
merged commit ea1c8ef
into
sparrowDom/balancer-composable-st-pool
12 of 18 checks passed
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
BaseBalancerStrategy's cachePoolAssets increases the length of poolAssets list with every call, extending the list by the same assets every time. Calling this method more than once will cause DoS via several paths:
Crucially,
cachePoolAssetslacks access control and as a result, is callable by anyone.Thus, a malicious second call to this function will break the deposit and withdrawal
functionality of all Balancer strategies.
Consider checking that the
poolAssetsarray is empty at the beginning ofcachePoolAssets