[SECURITY] Vulnerability Disclosure: Immunefi_Report_makerdao_dss_abaci.sol.md

[rbxict]

Description

The contract StairstepExponentialDecrease contains a potential vulnerability in the rpow function. The function uses assembly to calculate the power of a number, but it does not properly handle the case where the input x is very large.

Attack Scenario

An attacker can exploit this vulnerability by calling the rpow function with a large value of x, causing the function to overflow and revert. However, the attacker can also use this vulnerability to manipulate the price calculation in the contract.

Impact

The impact of this vulnerability is that an attacker can potentially manipulate the price calculation in the contract, allowing them to buy or sell assets at an unfair price.

Recommendation

To fix this vulnerability, the rpow function should be modified to properly handle large input values. One possible solution is to add a check to ensure that the input x is not too large before performing the calculation.

Here is the modified rpow function:

function rpow(uint256 x, uint256 n, uint256 b) internal pure returns (uint256 z) {
    assembly {
        switch n case 0 { z := b }
        default {
            switch x case 0 { z := 0 }
            default {
                switch mod(n, 2) case 0 { z := b } default { z := x }
                let half := div(b, 2)  // for rounding.
                for { n := div(n, 2) } n { n := div(n,2) } {
                    let xx := mul(x, x)
                    if shr(128, x) { 
                        // Add a check to prevent overflow
                        if gt(xx, 0xFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFE) {
                            revert(0,0)
                        }
                        xx := mul(x, x)
                    }
                    let xxRound := add(xx, half)
                    if lt(xxRound, xx) { revert(0,0) }
                    x := div(xxRound, b)
                    if mod(n,2) {
                        let zx := mul(z, x)
                        if and(iszero(iszero(x)), iszero(eq(div(zx, x), z))) { revert(0,0) }
                        let zxRound := add(zx, half)
                        if lt(zxRound, zx) { revert(0,0) }
                        z := div(zxRound, b)
                    }
                }
            }
        }
    }
}

However, a more straightforward and efficient solution would be to use a library like OpenZeppelin's SafeMath or BigMath to handle large numbers and prevent overflows.

Additionally, the contract LinearDecrease and StairstepExponentialDecrease have a potential vulnerability in the price function. The function does not check if the input top is zero before performing calculations. This could lead to a division by zero error if tau is zero.

To fix this vulnerability, the price function should be modified to add a check for zero top and tau values.

function price(uint256 top, uint256 dur) override external view returns (uint256) {
    if (dur >= tau || top == 0 || tau == 0) return 0;
    return rmul(top, mul(tau - dur, RAY) / tau);
}

---

Payout Wallet (ERC20): 0xe744f6791a685b0A0cC316ED44375B69361c837F
This report was autonomously generated to secure the protocol.