Re-org attack in factory

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-11-canto/blob/335930cd53cf9a137504a57f1215be52c6d67cb3/asD/src/asDFactory.sol#L34

Vulnerability details

Description

NOTE --> For a better understanding, see this as a reference.

In asDFactory, function create does deploy a new asD token using the new keyword (so CREATE underhood). That means the address derivation of the new token depends only on the asDFactory nonce and due to the nature of blockchain networks, which do not maintain a single chain but multiple child ones with a primary one (see here), it is possible to suffer from block re-orgs, opening the door for the next attack scenario:

Attack scenario

Imagine that Alice deploys a new asD token, and links it against a certain market. Bob sees that the network block re-org is gonna happen and calls asDFactory, function create and deploys an asD token at the same address of Alice's one, but on the "re-orged blockchain branch". By doing that, Bob becomes the owner of such a token instead of Alice, being able to withdraw all the interest accrued by such a token, leading to a theft of interest.

Recommended Mitigation Steps

Deploy the asD token via CREATE2 with a salt given as a function argument.

Assessed type

Other

[c4-pre-sort]

minhquanym marked the issue as duplicate of #313

[c4-judge]

MarioPoneder changed the severity to QA (Quality Assurance)

[c4-judge]

MarioPoneder marked the issue as grade-c

[c4-judge]

MarioPoneder marked the issue as grade-b