Skip to content

Latest commit

 

History

History
52 lines (31 loc) · 2.35 KB

088.md

File metadata and controls

52 lines (31 loc) · 2.35 KB

Bald Cloud Pony

Medium

Users can manipulate pool reserve balance to end auction in their favor

Summary

The use of the pool contract reserve token balance during endAuction opens a possibility for users to manipulate the pool balance and force auction closure with the preferred outcome.

Root Cause

In Auction.sol:341 there is a check of the pool balance of reserve token to not exceed poolSaleLimit:

https://github.com/sherlock-audit/2024-12-plaza-finance/blob/main/plaza-evm/src/Auction.sol#L341-L341

Users can manipulate this condition by supplying or withdrawing a specific amount of reserve tokens according to their intent.

Internal Pre-conditions

  1. The auction ended with enough coupon tokens accumulated from bids.

External Pre-conditions

No response

Attack Path

  1. The auction is at the end of the bidding period and has accumulated enough coupon tokens to end successfully
  2. The levETH holder sees that the reserve token amount to be sent from the pool does not exceeds poolSaleLimit thus auction will succeed
  3. The levETH holder redeems their levETH thus decreasing the reserve token balance to the level to not pass poolSaleLimit
  4. The levETH holder calls endAuction() and the auction ends with the state State.FAILED_POOL_SALE_LIMIT
  5. The levETH holder buys back their levETH tokens

Note that a similar attack can be executed in the opposite direction by bondETH holders, if they see it being profitable, to make poolSaleLimit check pass.

Incentives for the attack:

  1. Holders of bondETH are incentivized to end auctions with State.SUCCEEDED otherwise they will not receive coupon payments
  2. Holders of levETH are incentivized to end auctions with State.FAILED_POOL_SALE_LIMIT to prevent coupon payments, as this decreases reserves and, thus, the levETH token price.

Impact

  1. poolSaleLimit can be bypassed jeopardizing the pool's financial health.
  2. bondETH holders may not receive coupon payments while levETH holders unfairly benefit from holding reserves and levETH price unchanged.
  3. levETH holders may incur losses due to reserves (and thus levETH price) falling below expectations while bondETH holders unfairly benefit from the forced coupon distribution.

PoC

No response

Mitigation

One possible mitigation could be to introduce a cooldown period for creation and redemption of bondETH and levETH.