Assessment reportsPublic findings
Back to Zellic site
↗
Assessment reports>Initia>High findings>Next zapping ID potentially duplicated
GeneralOverview
Findings
Critical (3)
High (12)Missing gas charge on memo in native_nft_transferNext zapping ID potentially duplicatedPublished module names do not necessarily match binary moduleStablepools can be created with one or no assetsStablepool swap can be called, repeating the same assetFrozen module coin store can cause chain haltMalicious proposer can skip fee checkMove coins can be burned twiceQuery gas limit not enforced through bank moduleIncorrect signer check for shorthand accountsValidator set updates can skip current validatorsWithdrawal hash clash using variable-length fields
Medium (4)
Low (9)
Informational (3)
DiscussionGeneral DiscussionImprove AMM testsBridge executor minting powerCharge before using valuesEmpty allowed_publishers array allows every address to publishERC20Keeper with custom contractsSuggestions for additional security checksTable handle overflow leads to abort
Threat ModelWhat are threat models?stdlib
Audit ResultsSummary
AppendixProof of concept: Reference safety verifier bypass
Category: Coding Mistakes

Next zapping ID potentially duplicated

High Severity
High Impact
High Likelihood

Description

The Initia chain allows vesting rewards from L2s to be released early and put into a liquidity pool. The liquidity token is then locked for the required period. This is known as zapping. When a user uses this feature, a Zapping object is created to record the details of the zapping. Each object has a unique ID, which is used to look it up in a table. The code to determine the ID is as follows.

let zid = table::length(&module_store.zappings);

assert!(!table::contains(&module_store.zappings, zid), error::already_exists(EZAPPING_ALREADY_EXIST));

If deletions have happened in the table, for example if a user has fully released their zapping, the length of the table may no longer match the last ID. At this point, it would no longer be possible to add new zappings until a sufficient number is deleted.

Impact

This is a highly likely scenario causing the zapping feature to be unusable. We suspect in practice the above DOS condition will consistently hold true.

Recommendations

Use a ID-generation scheme uncorrelated to the length of the table.

Remediation

Zellic © 2024Back to top ↑