Anyone can use burnDyad for others notes ids and block their transactions

[c4-bot-3]

Lines of code

https://github.com/code-423n4/2024-04-dyad/blob/4a987e536576139793a1c04690336d06c93fca90/src/core/Dyad.sol#L46

Vulnerability details

Impact

burnDyad could cause DoS for other users transactions when they attempt to burn their full amount of dyad.

Proof of Concept

burnDyad is allowing the user to burn dyad amounts for his note id and other users note ids, It seems a part of the protocol design that allow such a feature to make burn dyad availabe not only for self burn amount of mintedDyad, also for others.

After investigating the method, we can see that dyad.burn(id, msg.sender, amount) is being called from VaultManagerV2 address as the caller (msg.sender), now if we move further to burn method, we will find that _burn(from, amount) is burning Dyad ERC20 tokens from the user caller address, moving forward in the next line mintedDyad[msg.sender][id] -= amount it seems that an amount is being decreased from mintedDyad mapping for the passed note id.

The case of the issue:
Supposed Bob would like to burn a 100 Dyad (his max Dyad minted amount) to achieve a withdraw for his collateral, Bob will call burn passing 100e18 amount as 100 of Dyad tokens, Alex will front-run Bob and call burn method, passing the note id of Bob (let's say id 8) with a minimum amount of 1 WEI Dyad , Bob's transaction will fail since his amount of mintedDyad become less than 100e18 and it will revert here mintedDyad[msg.sender][id] -= amount.

Since no check for isDNftOwner modifier on burn method, anyone can pass different note ids for other users and decrease their mintedDyad amount, this attack is cheap.

Tools Used

Manual Review

Recommended Mitigation Steps

Add isDNftOwner modifier on burn method, update other parts of the code accordingly.

Assessed type

DoS

[c4-pre-sort]

JustDravee marked the issue as duplicate of #409

[c4-pre-sort]

JustDravee marked the issue as sufficient quality report

[c4-judge]

koolexcrypto marked the issue as unsatisfactory:
Invalid

[c4-judge]

koolexcrypto marked the issue as not a duplicate

[c4-judge]

koolexcrypto marked the issue as duplicate of #74

[c4-judge]

koolexcrypto marked the issue as nullified

[c4-judge]

koolexcrypto marked the issue as not nullified

[c4-judge]

koolexcrypto marked the issue as duplicate of #992

[c4-judge]

koolexcrypto marked the issue as satisfactory

[c4-judge]

koolexcrypto marked the issue as duplicate of #100