DOS+griefing attack for AuraVestedEscrow contract by calling fund() because it does not have access control and anyone can call it and initialize contract with wrong parameters

[code423n4]

Lines of code

https://github.com/code-423n4/2022-05-aura/blob/4989a2077546a5394e3650bf3c224669a0f7e690/contracts/AuraVestedEscrow.sol#L96-L110

Vulnerability details

Impact

There is no access control in fund() and anyone can call it. This function is only is callable one time for a contract and initializes the contract. An attacker can call this function of any deployed contract exactly after deployment with dummy parameters and make contract to become useless. it will cause deployer to pay deployment gas fee and even the impact is larger if the address of this contract has been used in other contracts.

Proof of Concept

This is fund() code in AuraVestedEscrow:

function fund(address[] calldata _recipient, uint256[] calldata _amount) external nonReentrant {
        require(!initialised, "initialised already");

        uint256 totalAmount = 0;
        for (uint256 i = 0; i < _recipient.length; i++) {
            uint256 amount = _amount[i];

            totalLocked[_recipient[i]] += amount;
            totalAmount += amount;

            emit Funded(_recipient[i], amount);
        }
        rewardToken.safeTransferFrom(msg.sender, address(this), totalAmount);
        initialised = true;
    }

As you can see, deployer needs to call this contract after deployment and this function is only callable one time. but attacker can watch contract deployments and immediately call fund([],[]) and initiate deployed contract with dummy parameters and make deployer lose deployment gas paid. So attacker can completely block usage of this contract for all deployments.

Tools Used

VIM

Recommended Mitigation Steps

Check that msg.sender in fund is owner or other mechanism that prevent hacker from performing DOS

[0xahtle7]

Duplicated of #163

[dmvt]

I'm going to downgrade this one to a gas issue given that the worst impact is a required redeploy. The suggested mitigation is valid.