Description

The protocol relies heavily on the synthereum finder to provide the correct addresses for critical contract interactions such as the price feed, lending manager, lending storage manager, commission receiver, buy back program receiver, and the interest bearing token. For example,

function _getPriceFeedRate(
  ISynthereumFinder _finder,
  bytes32 _priceIdentifier
) internal view returns (uint256) {
  ISynthereumPriceFeed priceFeed =
    ISynthereumPriceFeed(
      _finder.getImplementationAddress(SynthereumInterfaces.PriceFeed)
    );

  return priceFeed.getLatestPrice(_priceIdentifier);
}

Impact

Although the function in _finder that manages the contract addresses is access controlled (as shown in the code below), compromised keys could result in exploitation. For example, an attacker could change the priceFeed to a malicious contract. The compromised priceFeed could report a heavily depressed price to allow the attacker to mint a large number of synthetic tokens for very little collateral. The attacker could then massively increase the price to redeem synthetic tokens for a large amount of collateral, effectively draining the pool of its collateral assets.

function changeImplementationAddress(
  bytes32 interfaceName,
  address implementationAddress
) external override onlyMaintainer {
  interfacesImplemented[interfaceName] = implementationAddress;

  emit InterfaceImplementationChanged(interfaceName, implementationAddress);
}

Recommendations

The use of a multisignature address wallet can prevent an attacker from causing economic damage in the event a private key is compromised. Timelocks can also be used to catch malicious executions, such as a change to the implementationAddress of the priceFeed.

Remediation

Jarvis is aware of the centralization risks introduced by the synthereum finder but emphasizes the importance of the synthereum finder in mitigating attacks from imposter contracts such as fake pools. They acknowledge that the synthereum finder could be compromised by leaked keys and, therefore, have implemented the following multistage protection protocol:

1. The synthereum finder is controlled by an Admin account and a Maintainer account. The Admin account controls the Admin and Maintainer roles while the Maintainer controls the addresses pointed to by the synthereum finder. In the event the Maintainer is compromised, the Admin role can revoke its rights.

2. Both the Admin and Maintainer roles are managed by two of four signature Gnosis Safe multisigs.

3. Ledger devices are used as signers of the multisigs to add an additional layer of security over hot wallets. Jarvis has further indicated that the Ledger keys are distributed among different company officers and are stored securely.

In the future, the Admin and Maintainer roles will be moved to an on-chain DAO and the multisig will be upgraded to a three of five. At that time, time-lock mechanisms may also be introduced.