EFCCWEB3 - Threshold not used!

[sherlock-admin2]

EFCCWEB3

Medium

Threshold not used!

nonceThresh
The invalidateNonce and invalidateUpToNonce functions in the smart contract allow users to invalidate specific nonces or a range of nonces. However, these functions do not account for the nonceThreshold set by setNonceThreshold. This creates inconsistencies and potential vulnerabilities in the nonce management mechanism, as users may invalidate nonces above the threshold, potentially causing confusion and weakening security.

Vulnerability Details

function invalidateNonce() external {
        uint256 nonceUsed = _useNonce(msg.sender);
        _daoCollateralStorageV0()._orderAmountTaken[msg.sender] = 0;
        emit NonceInvalidated(msg.sender, nonceUsed);
    }

    /// @inheritdoc IDaoCollateral
    function invalidateUpToNonce(uint256 newNonce) external {
        _invalidateUpToNonce(msg.sender, newNonce);
        _daoCollateralStorageV0()._orderAmountTaken[msg.sender] = 0;
        emit NonceInvalidated(msg.sender, newNonce - 1);
    }

The contract includes three functions that interact with the nonce system:

invalidateNonce: Invalidates the current nonce for the caller.

invalidateUpToNonce: Invalidates all nonces up to a specified newNonce for the callernoncnonsetNonceThreshold: Sets a nonceThreshold, which likely represents the minimum valid nonce, invalidating all nonces below this threshold to protect against replay attacks.

However, invalidateNonce and invalidateUpToNonce allow users to invalidate nonces above the nonceThreshold, which undermines the purpose of the threshold as a limit on valid nonces. Without alignment across these functions, nonce management is inconsistent, and users can potentially circumvent the nonceThreshold.

Recommendation

Add require statements in both invalidateNonce and invalidateUpToNonce to prevent invalidating nonces above nonceThreshold.