Upgraded Q -> 2 from #385 [1699689442074]

Judge has assessed an item in Issue 385 as 2 risk. The relevant finding follows: L-04 ODSafeManager.allowSAFE function enables any allowed address to add/remove other allowed addresses Details The ODSafeManager.allowSAFE function is meant by design to allow/disallow any address to manage the safe...

Upgraded Q -> 2 from #193 [1699029806458]

Judge has assessed an item in Issue 193 as 2 risk. The relevant finding follows: Missing functions in the BasicActions to reach ODSafeManager Description Both functions allowing other users and handlers to manage the safe are restricted with access control. Only callable by the owner of the safe...

Upgraded Q -> 2 from #300 [1699029650174]

Judge has assessed an item in Issue 300 as 2 risk. The relevant finding follows: L-01 transferSAFEOwnership does not reset users allowed to modify a safe on behalf of an owner transferSAFEOwnership is not deleting potential allowed users in safeCan upon transferring a safe ownership. This could...

Delegating the call from ODProxy will make the changes in the context of ODProxy's storage layer which breaks the invariant.

Lines of code Vulnerability details Impact Making the delegate call to ODSafeManager will affect the storage of ODProxy leaving behind the inconsistent state in ODSafeManager, moreover this issue will also breaks the invariant 'Users must exclusively use the ODProxy to interact with their safes.'...

All functions in ODSafeManager.sol related to handlerAllowed modifier can never be called.

Lines of code Vulnerability details Impact All the functions with handlerAllowed modifier are unusable and can never be called. Proof of Concept Handler is deployed and assigned to the Safe/NFT when ODSafeManager.sol/openSAFE function is called. The SafeHandler.sol have only a constructor and not...

ODSafeManager#allowSAFE() cannot be executed either by the proxy contract or any other address.

Lines of code Vulnerability details Impact "According to the GEB framework, the proxy contracts ODProxy are designed to interact with the Safe Manager ODSafeManager through the Proxy Action contract BasicActions. The pivotal function, allowSAFE, is responsible for granting an address the capabili...

When Creating a Safe Via ODSafeManager::openSAFE, the User Proxy Is Wrongly Set As the Safe Owner

Lines of code Vulnerability details Impact We can observe from Vault721::mint function that the input usr in ODSafeManager::openSAFE function needs to be a previously built proxy of the user address. function mintaddress proxy, uint256 safeId external requiremsg.sender == addresssafeManager, 'V72...

Missing functionality required to allow others access to safe

Lines of code Vulnerability details Impact Missing functionality prevents ODProxy from granting other accounts access to the safe. In order to grant access to the particular safe for which specific instance of ODProxy is the owner, it is necessary to call allowSAFE on ODSafeManager. This method...

User can manipulate coinBalance to have better collateralization rate

Lines of code Vulnerability details Impact Users can manipulate coinBalance mapping in the SafeEngine by calling ODSafeManager::transferInternalCoins in order to improve their collateralization rate generate more and repay less debt. Proof of Concept When a user wants to be able to generate debt...

Manipulation of NFV can trick it's buyer to have it on unexpected condition.

Lines of code Vulnerability details Impact NFV can be sold at a price not expected by the user or may be susceptible to liquidation shortly after buying it. Proof of Concept openSAFE function in ODSafeManager is supposed to be called by the ODProxy and mints nft for it, furthermore it calls...

ODProxy is flawed due to delegatecall to ODSafeManager which render system inoperable

Lines of code Vulnerability details Impact The vulnerability arises from the use of delegatecall to interact with the ODSafeManager contract, which is designed to store the context of the safe manager. However, the data inside ODSafeManager is never properly updated when ODProxy uses delegatecall...

Updating safeManager reference in Vault721 will brick transfer of safes

Lines of code Vulnerability details Impact Updating safeManager reference in Vault721 will brick safe transfers since the state of the new ODSafeManager instance won't have corresponding data. In addition, it is not clear how it would be possible to achieve seamless migration as particular...