smbv-1923 - DOS attack while using repayBorrowWithPermit()

[sherlock-admin2]

smbv-1923

Medium

DOS attack while using repayBorrowWithPermit()

Summary

• DOS attack while using repayBorrowWithPermit()

Vulnerability Detail

• ERC20Permit uses the nonces mapping for replay protection. Once a signature is verified and approved, the nonce increases, invalidating the same signature being replayed.
  repayBorrowWithPermit() expects the holder to sign their tokens and provide the signature to contract as part of permitData.
• When a repayBorrowWithPermit() transaction is in the mempool, an attacker can take this signature, call the permit function on the token themselves.
• Since this is a valid signature, the token accepts it and increases the nonce.
• This makes the spender's transaction fail whenever it gets mined.

Impact

• Attacker can make sure all calls to repayBorrowWithPermit() fail.
• Normal user have to pay more interest as due to increase of block.number

Code Snippet

• https://github.com/unioncredit/union-v2-contracts/blob/master/contracts/market/UDai.sol#L9

Tool used

Manual Review

Recommendation

• In repayBorrowWithPermit() function, check if it has the approval it needs. If not, then only submit the permit signature.
• Now even if attacker call the permit function on the token themselves before the user then also the function would work properly and no revert would be thrown.

Duplicate of #65