- Vulnerability Discovery
- Mechanism of the Vulnerability
- Countermeasures and Consequences
The decentralized auditing platform Code4rena discovered a vulnerability in an upcoming patch of the DittoETH algorithmic stablecoin platform. The exploit would have allowed a user with a large amount of deposited tokens to make excessive profits, increasing bad debts in the protocol and ultimately compromising its ability to survive.
Vulnerability Discovery
The vulnerability was identified by Code4rena, a crowd-sourced auditing platform. This discovery ensures that the vulnerability will not be added to the production version of DittoETH, as it has been mitigated in a newer test version.
Code4rena's participants are divided into three groups: sponsors, wardens, and judges. Sponsors are Web3 protocols that offer rewards for discovering vulnerabilities. Wardens compete to discover vulnerabilities in exchange for prize money. Judges adjudicate disputes between sponsors and wardens about whether a vulnerability is real and its severity.
Mechanism of the Vulnerability
According to a report from one of the Code4rena wardens, the vulnerability was related to a faulty mechanism for distributing stablecoin rewards to depositors in DittoETH's yDUSD vault. Users can add the stablecoin dUSD to this vault to receive a yield.
The warden discovered a mathematical flaw in the "matchIsDiscounted" function that could create large amounts of debt from a small amount of trading volume, contradicting the protocol's intended design. This could lead to disproportionate new debt creation and token minting.
Countermeasures and Consequences
After identifying the vulnerability, the warden posted an explanation on the project's GitHub. Initially, the DittoETH team and at least one Code4rena judge claimed that an attacker would not be able to create bad debt because other members would join the pool and "dilute" the attacker's gains.
However, further tests demonstrated that the attack was indeed possible, allowing the attacker to gain significant profits. Ultimately, the judge confirmed the vulnerability, and the DittoETH representatives acknowledged its validity.
This vulnerability concerned a non-production copy of the protocol's code. However, if it had been missed, it could have been deployed to the blockchain and exploited by attackers.
The discovered vulnerability in the DittoETH platform highlights the importance of thorough and regular audits to ensure the security of DeFi protocols. In this case, the prompt actions of Code4rena helped prevent potential financial losses and damage to the platform's reputation.
