kevinkien - Salt Attack Vulnerability in VoteDelegateFactory create Function

[sherlock-admin2]

kevinkien

Medium

Salt Attack Vulnerability in VoteDelegateFactory create Function

Summary

The create function in the VoteDelegateFactory contract uses a predictable salt value (bytes32(uint256(uint160(msg.sender)))) when creating VoteDelegate contracts. This could lead to a salt attack, where an attacker can predict the address of the new contract and pre-create a contract at that address, potentially altering the contract's behavior.

Vulnerability Detail

The VoteDelegateFactory contract uses a salt to calculate the address of a newly created VoteDelegate contract. However, the current salt value is simply a hash of the user's address (msg.sender). If an attacker can predict the user's address, they can pre-calculate the VoteDelegate contract address and deploy a malicious contract at that address before the user initiates the transaction.

Impact

If an attacker successfully executes a salt attack, they can modify the behavior of the newly created VoteDelegate contract. This could lead to a loss of control over the voting delegation process, allowing the attacker to manipulate votes or perform other unauthorized actions.

Code Snippet

https://github.com/sherlock-audit/2024-06-makerdao-endgame/blob/main/vote-delegate/src/VoteDelegateFactory.sol#L62

voteDelegate = address(new VoteDelegate{salt: bytes32(uint256(uint160(msg.sender)))}(chief, polling, msg.sender));

Tool used

Manual Review

Recommendation

a more random and unpredictable salt value should be used. One approach is to combine the user's address with some other random or unpredictable data, such as the current timestamp or a random number generated by an oracle.

function create() external returns (address voteDelegate) {
+    bytes32 salt = keccak256(abi.encodePacked(msg.sender, block.timestamp, block.difficulty)); // More random salt
+    voteDelegate = address(new VoteDelegate{salt: salt}(chief, polling, msg.sender));
    created[voteDelegate] = 1;

    emit CreateVoteDelegate(msg.sender, voteDelegate);
}

Duplicate of #63