Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

shaflow01 - Nonce verification is not performed in sequential order. #293

Open
sherlock-admin3 opened this issue Nov 17, 2024 · 0 comments

Comments

@sherlock-admin3
Copy link

sherlock-admin3 commented Nov 17, 2024

shaflow01

Medium

Nonce verification is not performed in sequential order.

Summary

In the claim function, the nonce check is not strictly enforced in sequential order, which may lead to frontrunning attacks or re-org and render some users' signatures invalid.

Root Cause

In the claim function, the nonce check does not enforce a strictly incremental requirement.

        if (_params.nonce <= nonces[_params.kycAddress]) {
            revert InvalidNonce();
        }

        if (!_isSignatureValid(_params)) {
            revert InvalidSignature();
        }

        // update nonce
        nonces[_params.kycAddress] = _params.nonce;

https://github.com/sherlock-audit/2024-11-vvv-exchange-update/blob/1791f41b310489aaa66de349ef1b9e4bd331f14b/vvv-platform-smart-contracts/contracts/vc/VVVVCTokenDistributor.sol#L115

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

  1. The user receives two signatures with nonce=1 and nonce=2 and can either initiate sequential transactions to execute these two claims or combine both claim calls into a single atomic transaction.
  2. For the first scenario, if a block reorganization occurs and the transaction with nonce=2 is executed first, the contract will update the user's nonce to 2. When the transaction with nonce=1 is later executed, it will fail (revert) because the nonce in the contract no longer matches the nonce in the signature, making the transaction invalid.
  3. For the second scenario, a malicious actor can front-run the user's nonce=2 signautre claim transaction. Once the malicious claim is executed, the user's nonce in the contract will be updated to 2. Consequently, the user's own nonce=2 claim transaction will fail due to a nonce mismatch, and their nonce=1 claim transaction will also be invalidated because the contract's nonce has already been advanced, preventing it from being executed.

Impact

Some of the user's signatures for specific nonces may become invalid and cannot be executed, leading to potential financial losses.

PoC

No response

Mitigation

-       if (_params.nonce <= nonces[_params.kycAddress]) {
+       if (_params.nonce == nonces[_params.kycAddress] + 1) {
            revert InvalidNonce();
        }

        if (!_isSignatureValid(_params)) {
            revert InvalidSignature();
        }

        // update nonce
        nonces[_params.kycAddress] = _params.nonce;
@sherlock-admin3 sherlock-admin3 changed the title Magnificent Maroon Cuckoo - Nonce verification is not performed in sequential order. shaflow01 - Nonce verification is not performed in sequential order. Nov 23, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant