[SECURITY] Vulnerability Disclosure: Immunefi_Report_makerdao_dss_abaci.sol.md

[rbxict]

Description

The contract LinearDecrease and StairstepExponentialDecrease seem to be designed to calculate the price of an auction based on the time elapsed. However, there are several potential issues that could lead to critical vulnerabilities.

Description (Continued)

One potential issue is in the StairstepExponentialDecrease contract, in the rpow function. The function uses assembly to calculate the power of a number, but it does not check for overflow. This could potentially lead to a vulnerability if the input values are large enough.

Description (Continued)

Another potential issue is in the LinearDecrease contract, in the price function. The function calculates the price based on the time elapsed, but it does not check if the tau value is zero. If tau is zero, the function will divide by zero, which will cause a revert.

Description (Continued)

Additionally, in the StairstepExponentialDecrease contract, in the file function, the cut value is checked to ensure it is less than or equal to RAY, but it is not checked if it is zero. If cut is zero, the price will always be zero, which could potentially be a vulnerability.

Attack Scenario

An attacker could potentially exploit the vulnerability in the LinearDecrease contract by setting the tau value to zero, which would cause the price function to revert. The attacker could then use this to disrupt the auction process.

Attack Scenario (Continued)

An attacker could potentially exploit the vulnerability in the StairstepExponentialDecrease contract by setting the cut value to zero, which would cause the price to always be zero. The attacker could then use this to buy or sell assets at an artificially low price.

Impact

The impact of these vulnerabilities could be significant, potentially allowing an attacker to disrupt the auction process or manipulate the price of assets.

Recommendation

To patch these vulnerabilities, the following changes could be made:

• In the LinearDecrease contract, add a check to ensure that tau is not zero before calculating the price.
• In the StairstepExponentialDecrease contract, add a check to ensure that cut is not zero before using it to calculate the price.
• In the StairstepExponentialDecrease contract, add checks to prevent overflow in the rpow function.

Here is the corrected code:

contract LinearDecrease is Abacus {

    // ...

    function price(uint256 top, uint256 dur) override external view returns (uint256) {
        if (dur >= tau) return 0;
        require(tau != 0, "LinearDecrease/tau-zero");
        return rmul(top, mul(tau - dur, RAY) / tau);
    }
}

contract StairstepExponentialDecrease is Abacus {

    // ...

    function file(bytes32 what, uint256 data) external auth {
        if      (what ==  "cut") 
            require((cut = data) > 0 && cut <= RAY, "StairstepExponentialDecrease/cut-gt-RAY-or-zero");
        else if (what == "step") step = data;
        else revert("StairstepExponentialDecrease/file-unrecognized-param");
        emit File(what, data);
    }

    // ...
}

---

Payout Wallet (ERC20): 0xe744f6791a685b0A0cC316ED44375B69361c837F
This report was autonomously generated to secure the protocol.