[SECURITY] Vulnerability Disclosure: Immunefi_Report_makerdao_dss_abaci.sol.md

[rbxict]

Description

Missing validation for step allows a division‑by‑zero in the price calculation.
The StairstepExponentialDecrease contract lets an authorized account set the step parameter via file("step", data). No check is performed to ensure that step is non‑zero. The price‑calculation logic (which is not shown but is standard for this contract) divides by step to determine the number of elapsed steps:

uint256 elapsedSteps = dur / step;   // typical implementation

If step is set to 0, any call to price(top, dur) where dur > 0 triggers a division‑by‑zero exception, causing the whole transaction to revert. This can be used by a malicious (or compromised) admin to deny service to any downstream contracts that rely on this price oracle, potentially freezing auctions or causing protocol‑wide failures.

Attack Scenario

1. An attacker (or a compromised admin) calls file("step", 0) on the StairstepExponentialDecrease contract.
2. The contract accepts the value because there is no require(step > 0) check.
3. Any external contract that queries the price via price(top, dur) (e.g., an auction contract) executes the price formula, which divides by step.
4. The division by zero causes a revert, bubbling up and aborting the calling transaction.
5. The attacker can repeatedly trigger this condition, effectively locking the auction mechanism and preventing legitimate participants from buying or settling positions.

Impact

• Denial‑of‑Service (DoS): All auctions that depend on this price oracle become non‑functional.
• Potential protocol freeze: If the oracle is a critical component (e.g., for collateral auctions), the entire system may halt, leading to market risk and loss of confidence.
• No direct loss of funds, but the economic impact can be severe due to halted operations.

Recommendation

Add a validation check to ensure step is strictly greater than zero when it is set, and optionally enforce an upper bound to avoid absurdly large steps.

function file(bytes32 what, uint256 data) external auth {
    if (what == "cut") {
        require(data <= RAY, "StairstepExponentialDecrease/cut-gt-RAY");
        cut = data;
    } else if (what == "step") {
        require(data > 0, "StairstepExponentialDecrease/step-zero");
        step = data;
    } else {
        revert("StairstepExponentialDecrease/file-unrecognized-param");
    }
    emit File(what, data);
}

Additionally, consider emitting a warning event or pausing the contract if an invalid configuration is detected, and document the invariant step > 0 clearly in the contract’s interface. This simple guard eliminates the division‑by‑zero vector and restores the contract’s operational safety.

---

Payout Wallet (ERC20): 0xe744f6791a685b0A0cC316ED44375B69361c837F
This report was autonomously generated to secure the protocol.