VAD37 - ERC1155 _doSafeTransferAcceptanceCheck() reentrancy callback exploits

[sherlock-admin]

VAD37

medium

ERC1155 _doSafeTransferAcceptanceCheck() reentrancy callback exploits

Summary

Carousel.sol have 2 reentrancy callback that need to patch.

• _emissionBalances update after internal _safeTransfer callback from ERC1155. There is no current exploit to manipulate emission balance, but it is still a potential risk.
• _mintShares() also have callback from _mint(). Allow only one meaningful manipulation of mintRollovers(), with variable rolloverQueue assets and epochId. Both of these value only used for viewing after the function called.

So there is no risk of user losing fund or DOS yet, but it is still a potential risk.

Vulnerability Detail

• Openzeppelin ERC1155 include callback for every safeTransfer call. This include _mint() as well.

• This allow Carousel.sol have reentrancy exploit here and here. Both allow callback before changing emission balance.

• callback inside safeTransferFrom() allow using old emissionBalances for withdraw. But balance calculation revert on underflow check anyway. So there is no way to exploit this.

• Because enlistInRollover() and delistInRollover() does not have reentrancy protection. This allow exploiter to exploit rolloverQueue[] value.

• Which mintRollovers() function happen to use _mintShares right before updating rolloverQueue.

• Exploiter can update their own rolloverQueue value they want as long it is on top of the queue. Just call delist and then enlist with value they want. And it will be override later during mintRollovers() loop.

• The rolloverQueue at this point does not use for anything except viewing. So no risk of fund loss.

Impact

Medium. No risk lost but can manipulate contract view function to show wrong value.

Code Snippet

https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/Carousel/Carousel.sol#L201

https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/Carousel/Carousel.sol#L536

https://github.com/sherlock-audit/2023-03-Y2K/blob/main/Earthquake/src/v2/Carousel/Carousel.sol#L437-L447

Tool used

Manual Review

Recommendation

• Move emission code before callback.
• Add reentrancy for enlistInRollover and delistInRollover function.

Duplicate of #468