Tapioca DAO audit contest

A public audit contest on Code4rena (omnichain money market), completed on 5th July 2023. 0xSimao placed #6. 10 of his findings are published: 9 high severity and 1 medium.

What Tapioca DAO is

Tapioca is an omnichain money market built on LayerZero, spread across five repositories with OFTv2 and ONFT721 token contracts carrying assets between chains.

The main repository is tapioca-bar: USDO, a stablecoin, BigBang, the CDP engine that mints and burns it, and Singularity, the isolated lending and borrowing markets.

Scope

Tapioca-bar and its supporting repositories: USDO, BigBang CDPs, Singularity lending markets and the omnichain token plumbing over LayerZero.

High severity findings

• TOFT in (m)TapiocaOft contracts can be stolen by calling removeCollateral() with a malicious removeParams.market
• TOFT removeCollateral can be used to steal all the balance
• All assets of (m)TapiocaOFT can be stealed by depositing to strategy cross chain call with 1 amount but maximum shares possible
• Attacker can block LayerZero channel due to missing check of minimum gas passed
• TOFT and USDO Modules Can Be Selfdestructed
• Exercise option cross chain message in the (m)TapiocaOFT will always revert in the destination, losing debited funds in the source chain
• BaseTOFT.sol: retrieveFromStrategy can be used to manipulate other user's positions due to absent approval check
• triggerSendFrom() will send all the ETH in the destination chain where sendFrom() is called to the refundAddress in the LzCallParams argument
• A user with a TapiocaOFT allowance >0 could steal all the underlying ERC20 tokens of the owner

Medium severity findings

• mTapiocaOFT can't be rebalanced because the Balancer in tapiocaz-audit calls swapETH() or swap() of the RouterETH but does not forward ether for the message fee

The contest

View the contest page