Category: Business Logic
Claimable token close can be subjected to denial of service via dust attack
Low Impact
Low Severity
Medium Likelihood
Description
When a claimable token account is about to be closed with a balance of zero, an attacker can perform a dust attack by transferring a very small amount of tokens with the same mint to that account before the close operation. This dust attack makes the balance nonzero, triggering the SPL token's zero-balance validation for close_account and causing the close operation to fail.
fn process_close_instruction<'a>(
program_id: &Pubkey,
token_account_info: AccountInfo<'a>,
authority_account_info: AccountInfo<'a>,
destination_account_info: AccountInfo<'a>,
eth_address: EthereumAddress,
) -> Result<(), ProgramError> {
...
invoke_signed(
&spl_token::instruction::close_account( // <-----
&spl_token::id(),
token_account_info.key,
destination_account_info.key,
authority_account_info.key,
&[authority_account_info.key],
)?,
&[token_account_info, destination_account_info, authority_account_info],
seeds,
)
}Impact
The Close instruction can be subjected to a denial-of-service attack, preventing rent reclamation.
Recommendations
Extract the balance before performing the close operation.