cds owners can withdraw more than expected via manipulating excessProfitCumulativeValue

Summary

excessProfitCumulativeValue in withdraw() can be manipulated. Malicious users can manipulate this excessProfitCumulativeValue to withdraw more than expected.

Root Cause

In CDS.sol:withdraw, cds owners can withdraw their usda deposit.

In withdraw(), there is one parameter excessProfitCumulativeValue, we will use this parameter excessProfitCumulativeValue to calculate the cds owner's possible profit. Although this parameter excessProfitCumulativeValue is signed by the admin, the signature and excessProfitCumulativeValue can be replayed. When different cds owners withdraw, they will get the different excessProfitCumulativeValue and signature from the protocol's backend server. Malicious users can choose any valid excessProfitCumulativeValue, nonce and signature from on-chain data.

Malicious users can choose one smaller excessProfitCumulativeValue to trigger withdraw() function. Malicious users can get more profit than expected.

    function withdraw(
        uint64 index, // deposit index.
        uint256 excessProfitCumulativeValue,
        uint256 nonce,
        bytes memory signature
    ) external payable nonReentrant whenNotPaused(IMultiSign.Functions(5)) {
        if (!_verify(FunctionName.CDS_WITHDRAW, excessProfitCumulativeValue, nonce, "0x", signature)) revert CDS_NotAnAdminTwo();

    function cdsAmountToReturn(
        address _user,
        uint64 index,
        uint128 cumulativeValue,
        bool cumulativeValueSign,
        uint256 excessProfitCumulativeValue
    ) private view returns (uint256) {
    ...
                    uint256 profit = (depositedAmount * (valDiff - excessProfitCumulativeValue)) / 1e11;
    ...
}

Internal pre-conditions

N/A

External pre-conditions

N/A

Attack Path

N/A

Impact

Malicious users can withdraw more profit than expected via manipulating the excessProfitCumulativeValue and signauture.

PoC

N/A

Mitigation

Enhance the signature check. One signature can only be used for one cds owner's specific deposit index.