Skip to content

Latest commit

 

History

History
18 lines (11 loc) · 1.16 KB

M-09.md

File metadata and controls

18 lines (11 loc) · 1.16 KB
Raw

swapSource in RNSourceController contract can be frontrunned and eventually lead to a DoS

Impact

A malicious randon source con frontrun calls to swapSource and prevent protocol owners from changing the random source by frontrunning the call with a transaction to onRandomNumberFulfilled which effectively resets the failedSequentialAttempts to zero, making the original call to swapSource revert.

This process can be repeated any number of times, eventually leading to a DoS and the impossibility of changing the random source.

Proof of Concept

  1. Source timeouts and doesn't return request response, retry is called until failedSequentialAttempts == maxFailedAttempts.
  2. Protocol owners call swapSource to change the random source of the contract
  3. Current random source frontruns the call with a call to onRandomNumberFulfilled which resets the failedSequentialAttempts back to 0.
  4. Original transaction from (2) gets reverted as failedSequentialAttempts is now less than maxFailedAttempts.

Recommendation

In case of maxFailedAttempts enter a more robust "pause" state that lets protocol owners deal better with the current situation.