WildSniper - The Vault contract in the Mellow protocol allows users to register withdrawal requests to an arbitrary address, potentially enabling malicious actors to disrupt the withdrawal process by registering withdrawals to blacklisted addresses.

[sherlock-admin4]

WildSniper

Medium

The Vault contract in the Mellow protocol allows users to register withdrawal requests to an arbitrary address, potentially enabling malicious actors to disrupt the withdrawal process by registering withdrawals to blacklisted addresses.

Summary

The Vault contract in the Mellow protocol allows users to register withdrawal requests to an arbitrary address, potentially enabling malicious actors to disrupt the withdrawal process by registering withdrawals to blacklisted addresses.

Vulnerability Detail

The registerWithdrawal function in the Vault contract permits users to specify a to address, which is the recipient address for the withdrawal request. This opens up a potential attack vector where a malicious user can repeatedly register withdrawal requests to blacklisted addresses, causing subsequent withdrawal operations to revert when attempting to process these requests.

Impact

The impact of this vulnerability is considered medium. It has the potential to break core contract functionality by disrupting the withdrawal process. If operators are forced to process withdrawals individually to avoid blacklisted addresses, it could lead to delays and inefficiencies. In a worst-case scenario, users might be compelled to initiate emergency withdrawals, potentially resulting in the loss of funds.

Code Snippet

The relevant code snippets are:

https://github.com/sherlock-audit/2024-06-mellow/blob/26aa0445ec405a4ad637bddeeedec4efe1eba8d2/mellow-lrt/src/Vault.sol#L434-L473

function registerWithdrawal(
    address to,
    uint256 lpAmount,
    uint256[] memory minAmounts,
    uint256 deadline,
    uint256 requestDeadline,
    bool closePrevious
) external nonReentrant checkDeadline(deadline) checkDeadline(requestDeadline) {
    // ...
    WithdrawalRequest memory request = WithdrawalRequest({
        to: to, // Arbitrary 'to' address
        // ...
    });
    // ...
}

function pendingWithdrawers(
    uint256 limit,
    uint256 offset
) external view returns (address[] memory result) {
    // ...
    for (uint256 i = 0; i < count; i++) {
        result[i] = withdrawers_.at(offset + i);
    }
    return result;
}

Tool used

Manual Review

Recommendation

To mitigate this vulnerability, the Vault contract should implement a mechanism to validate the to address in the registerWithdrawal function. This could involve maintaining a list of approved or blacklisted addresses and checking the to address against this list before allowing the withdrawal request to be registered. or to check by a call to usdc contract

Additionally, the processWithdrawals function should be modified to skip or handle withdrawal requests to blacklisted addresses gracefully, without reverting the entire operation.

Duplicate of #109