Comments (1)
alcueca
commented on July 28, 2024
The issue exists, and we appreciate raising it.
The solution can't be adding auth to createJoin, since anyone can use CREATE2 to deploy a Join with their own factory, but with our Join bytecode, occupying the same address we would.
The correct mitigation, in our opinion, is to ditch CREATE2 and deploy Joins using CREATE instead.
As for the risk, such a DoS attack wouldn't cause a loss of funds, or an interruption on user service. It would cause a governance action to revert, which would be quickly fixed by deploying a new JoinFactory and replacing the Wand. Fortunately, no contract uses the Wand as a Join registry (maybe we should!).
I suggest the risk is downgraded to 1.
from 2021-05-yield-findings.
Related Issues (20)
- Incompatibility With Rebasing/Deflationary/Inflationary tokens HOT 2
- flashFeeFactor is uninitialized at declaration leading to zero-fee flash loans enabled by default HOT 1
- Multiple compiler versions allowing a wide range from 0.5.0 to >=0.8.0 HOT 1
- Anyone can create a fake pool to trick unauthorized front-ends HOT 1
- unnecessary store HOT 1
- external function transferToPool is pretty useless
- function redeem should return 'redeemed' amount
- function build could explicitly check that seriesId is not 0 HOT 1
- Gas optimizations - using external over public
- In method _update on Pool.sol - Divide before multiply
- Missing zero address validation in transfer method HOT 2
- Reliance on undocumented quirk in RevertMsgExtractor HOT 2
- Witch lock vault waiting for better price HOT 2
- Unlock pragma used in multiple contracts HOT 2
- Add non-zero address check of recipients when transferring funds HOT 2
- Unnecessary `unchecked` keyword is used in `FYToken`
- Using stale cToken exchange rate HOT 1
- User can redeem more tokens by artificially increasing the chi accrual HOT 2
- Users can avoid paying borrowing interest after the fyToken matures HOT 3
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from 2021-05-yield-findings.