Wild Chili Nuthatch - Implementing Front-Running Protection in Smart Contracts: Commit-Reveal and Time-Based Lock Mechanisms

[sherlock-admin4]

Wild Chili Nuthatch

High

Implementing Front-Running Protection in Smart Contracts: Commit-Reveal and Time-Based Lock Mechanisms

Summary
https://github.com/sherlock-audit/2024-11-teller-finance-update/blob/0c8535728f97d37a4052d2a25909d28db886a422/teller-protocol-v2-audit-2024/packages/contracts/contracts/LenderCommitmentForwarder/extensions/LenderCommitmentGroup/LenderCommitmentGroup_Smart.sol#L928-L945

The code lacks front-running protection mechanisms, which makes it vulnerable to attacks where malicious actors can anticipate and exploit transactions. Specifically, the absence of commit-reveal or time-based locks allows for the possibility of front-running in functions such as loan liquidation or bidding. This could lead to unintended outcomes like unfair price manipulation or attackers profiting from knowing bid details in advance.

Root Cause
The root cause of the front-running vulnerability is the absence of any protection mechanism that would obscure the details of sensitive transactions (e.g., loan liquidations or bids) before they are finalized. Without commit-reveal schemes or time-based locks, the transaction details (such as bid amounts or liquidation parameters) are visible to all participants in the network, including potential attackers. This allows them to take advantage of this information by submitting their own transactions ahead of the legitimate ones, altering the outcome in their favor.

Internal pre-conditions

Lack of Transaction Privacy:

Transaction details such as bid amounts, liquidation conditions, or loan parameters are exposed on the blockchain before they are processed. This allows any participant to view the data, including potential front-runners.
No Commit-Reveal Mechanism:

There is no commit-reveal mechanism, which would normally allow participants to first commit to a transaction with a hash and later reveal the actual details. Without this mechanism, the details of bids or transactions are immediately available, enabling malicious actors to exploit the timing of their transactions.
Absence of Time-Based Locks:

No time-based lock or delay is implemented to prevent transactions from being executed too quickly or prematurely. This means that attackers can observe transaction data (such as price feeds or bid details) and submit their own transactions before the original transaction is mined.
These conditions allow the critical vulnerability of front-running, where attackers can take advantage of observable pending transactions to change the market conditions in their favor.

External pre-conditions

The external pre-conditions leading to the front-running vulnerability are:

Unpredictable Transaction Ordering:

Since Ethereum and other blockchain networks typically do not guarantee the order in which transactions are included in a block, miners or validators can choose to prioritize transactions based on gas price or other factors. This lack of transaction ordering guarantees can be exploited by front-runners who can submit their own transactions with higher gas fees to ensure their transactions are processed first.
Publicly Available Transaction Data:

Transactions in the mempool (the pool of pending transactions) are publicly visible to all participants. Front-runners can monitor the mempool for specific types of transactions (such as large bids, liquidations, or loan actions) and then attempt to submit their own transactions based on this visible data.
Unprotected External Calls (e.g., Oracle Prices or Auctions):

If external data sources, such as oracles (for price data) or auctions, are used in the logic of the smart contract, they may expose information about pending transactions or market conditions. If such data is accessible before the transaction is finalized, it can allow attackers to predict the outcome of a transaction and front-run it.
Lack of Front-End or Off-Chain Safeguards:

If the system’s front-end (user interface) or off-chain processes expose sensitive information (such as bids, collateral, or liquidation conditions) before the on-chain transaction is executed, it can provide an opportunity for external participants to exploit this information for front-running.

Attack Path

1. Observation of Pending Transactions:
   Step 1: Malicious actors (front-runners) continuously monitor the mempool for transactions that involve significant amounts of money or opportunities for profit, such as loan liquidations, large bids, or contract function calls like repayLoanCallback, liquidateLoan, or borrowLoan.
   Step 2: The front-runner identifies a transaction that could affect the price of collateral or principal tokens, such as a loan repayment or liquidation.
2. Analysis of Transaction Conditions:
   Step 3: The front-runner analyzes the details of the transaction in the mempool (publicly visible information such as loan amounts, collateral, time window, etc.) to understand how the transaction will affect the state of the protocol. This could include, for example:
   Understanding the potential price fluctuation due to collateral token movements in an auction.
   Recognizing a liquidateLoan transaction where the collateral is being sold at an unfavorable price for the borrower.
3. Reconstruction of Transaction Outcome:
   Step 4: The front-runner then reconstructs the expected outcome of the transaction:
   If it's a liquidation, they could estimate the collateral-to-principal token ratio or the incentive to liquidate (based on price fluctuations or auction behavior).
   If it's a loan repayment, they could estimate the changes in available liquidity or interest rates based on the transaction.
4. Execution of Front-Running Transaction:
   Step 5: The front-runner submits their own transaction with higher gas fees to ensure their transaction is processed before the original transaction.
   Step 6: The front-runner’s transaction is executed first, allowing them to either:
   Manipulate the price of collateral by engaging in trades or auction bids, making the liquidation more favorable for them.
   Disrupt the liquidation auction by participating in the liquidation process before the original transaction.
   Extract profits by exploiting the price discrepancy created by the transaction.
5. Completion of Malicious Transaction:
   Step 7: The front-runner's transaction is successfully processed before the original transaction, and they capitalize on the changes they made to the protocol state.
   Step 8: The originally intended transaction (e.g., loan repayment or liquidation) executes with its expected outcome, but now the attacker has gained an advantage, such as better collateral prices or a more favorable liquidation.
6. Profit Extraction:
   Step 9: The front-runner can extract profit from the manipulated transaction by either:
   Taking advantage of arbitrage opportunities created by price manipulation in collateral or principal tokens.
   Benefiting from liquidations where they can acquire tokens at a discounted price due to their prior intervention.
7. Repeat:
   Step 10: The attacker continues to observe transactions in the mempool and repeat the process, exploiting future transactions in a similar manner.
   Key Exploitable Vulnerabilities in the Path:
   Public Transaction Data: The ability to observe pending transactions in the mempool, such as loan liquidations or significant transfers, allows the front-runner to predict the effects of these transactions.
   Mempool Visibility: Transactions like repayLoanCallback, liquidateLoan, or borrowLoan can be used as indicators for front-running, especially if the conditions or amounts are sufficiently large or impactful.
   No Mechanism to Prevent Reordering: The lack of a commit-reveal mechanism or other ordering protections allows malicious actors to exploit transaction reordering by miners/validators for profit.

Impact

1. Financial Losses to Users
   Lenders and Borrowers: Front-running can result in users paying more for collateral or receiving less favorable terms during loan repayments or liquidations. For example:
   Lenders could experience reduced returns on their investment if a front-runner manipulates the collateral prices, resulting in a less profitable liquidation process or market conditions.
   Borrowers might face higher costs for liquidations if a malicious actor front-runs a liquidation transaction, acquiring the collateral at a price that they would have otherwise paid.
   Profit Reduction: If an attacker manipulates prices, users may end up paying more than they should for liquidations or token exchanges due to artificially inflated prices. Similarly, when prices are deflated, the attacker could benefit at the expense of the protocol or other users.
2. Loss of Protocol Integrity and Trust
   Market Manipulation: Repeated front-running can lead to market manipulation, undermining the integrity of the protocol. Users may begin to distrust the system, especially if they perceive that attackers can exploit transactions for personal gain.
   Reputation Damage: If front-running becomes known within the community or broader market, it could seriously damage the protocol’s reputation. Users expect fair treatment in financial markets, and manipulation undermines confidence in decentralized finance (DeFi) protocols.
   Reduced Participation: Users may become less willing to participate in the ecosystem if they fear they will be manipulated by front-runners, leading to lower transaction volumes and liquidity in the protocol.
3. Increased Gas Costs
   Higher Transaction Fees: Front-runners typically outbid the original transaction in terms of gas price to ensure that their transactions are processed first. This can artificially inflate gas prices, making transactions more expensive for everyone, especially if the front-runner's strategy requires multiple attempts or increased competition with other attackers.
   Inefficient Capital Usage: The increased gas costs and the need for frequent re-submissions of transactions can lead to inefficient use of capital for the protocol's users, raising the barrier to entry for smaller participants.
4. Impact on Liquidations
   Unfair Liquidation Auctions: In liquidation events, front-running can skew the price at which collateral is liquidated. If an attacker is able to front-run a liquidation, they may acquire the collateral at a significantly reduced price, harming the protocol's liquidation process. This could leave the protocol with insufficient collateral backing, especially in cases where the liquidation amount is critical for ensuring solvency.
   Financial Inefficiency: Front-running can prevent optimal liquidation outcomes, which might result in liquidations that are less profitable or fail to adequately cover the borrowed funds. This could leave lenders with a portion of their capital unrecovered.
5. Impact on Incentive Mechanisms
   Skewed Incentives: Many incentive mechanisms in DeFi protocols depend on the price of tokens, the amount of collateral, or the amount of liquidity provided. Front-running can distort these incentives, making it harder for users to accurately predict their rewards or the value of their investments.
   Reduced Effectiveness of Incentives: If an attacker can manipulate liquidation incentives or price adjustments, the protocol’s incentive structure may no longer effectively encourage the desired behaviors (e.g., liquidity provision or loan repayment).
6. Regulatory and Compliance Risks
   Regulatory Attention: The occurrence of front-running attacks might draw unwanted regulatory attention. Authorities may start to scrutinize the protocol more closely, considering whether these attacks constitute unfair market practices or breach laws related to market manipulation.
   Legal Exposure: If the protocol is found to be vulnerable to front-running, it could face legal challenges from users who believe they were unfairly impacted by such attacks, leading to potential lawsuits or reputational damage.

PoC

Assumptions:
The protocol relies on price queries from Uniswap pools (getUniswapV3TokenPairPrice), which can be manipulated by timing the execution of transactions.
No protection against front-running is implemented, so an attacker can place their transaction before the actual liquidation, which results in them acquiring the collateral at a favorable price.
PoC Attack Steps
Step 1: Set up a Liquidation Transaction

A borrower has defaulted on their loan, triggering a liquidation event.
A liquidation transaction is created, which will attempt to exchange collateral for the principal tokens, but the transaction has not yet been executed on-chain.
Step 2: Attacker Monitors Pending Transactions

The attacker observes the pending liquidation transaction, identifying the getUniswapV3TokenPairPrice or price oracle functions that will be used to execute the liquidation.
The attacker identifies the price at which collateral will be exchanged (via getUniswapV3TokenPairPrice).
Step 3: Attacker Front-Runs the Transaction

The attacker creates their own transaction, setting a higher gas price to ensure that it is included before the original liquidation transaction.
The attacker's transaction manipulates the price slightly in their favor by performing a small trade or interaction with the Uniswap V3 pool.
Since the liquidation depends on the price returned by the getUniswapV3TokenPairPrice function, which is based on the current state of the Uniswap pool, the attacker is able to influence the collateral-to-principal exchange rate by modifying the pool price.
Step 4: Liquidation Executed at a Different Price

The liquidation transaction is now processed after the attacker's transaction, and the collateral is exchanged at an unfavorable price for the borrower (the price has been adjusted in the attacker's favor).
The attacker profits from acquiring the collateral at a more favorable rate than the borrower would have received.
Step 5: The Attacker Reaps the Profits

The attacker receives the collateral tokens at the manipulated price, thereby acquiring the collateral at a value lower than what it should have been, leading to a financial gain.
Example Code for Simulating the Attack

// Example of an attacker contract simulating front-running behavior

pragma solidity ^0.8.0;

interface IUniswapV3Pool {
    function getSqrtTwapX96(uint32 twapInterval) external view returns (uint160);
    function observe(uint32[] calldata secondsAgos) external view returns (int56[] memory, uint160[] memory);
}

contract Attacker {
    IUniswapV3Pool uniswapPool;

    constructor(address _uniswapPool) {
        uniswapPool = IUniswapV3Pool(_uniswapPool);
    }

    // Function to front-run a liquidation event
    function frontRunLiquidation(uint256 amountToManipulate) external {
        // Step 1: Check the current price from Uniswap pool
        uint160 currentSqrtPrice = uniswapPool.getSqrtTwapX96(0); // Current price without any manipulation
        
        // Step 2: Manipulate the price by swapping tokens in the pool
        // This causes the price to shift, impacting the liquidation price
        // A small swap that alters the price
        manipulatePrice(amountToManipulate);

        // Step 3: Observe the new price after manipulation
        uint160 manipulatedPrice = uniswapPool.getSqrtTwapX96(0);
        
        // Step 4: Execute the liquidation with the manipulated price
        // Assuming the liquidation contract calls _getUniswapV3TokenPairPrice internally
        // The attacker can now exploit the difference in prices
        
        // Example interaction with liquidation function (simplified)
        // liquidationContract.liquidate(amountToManipulate, manipulatedPrice);
    }

    // Function to manipulate the price of the token pair
    function manipulatePrice(uint256 amount) internal {
        // Swap a small amount of tokens to change the pool price slightly
        // The attacker could use any logic to manipulate the price
        // For simplicity, we just execute a small trade (this depends on the token interaction)
        // In a real case, the attacker would perform trades that affect the price oracle
        
        // Example of a "manipulation" logic (simplified)
        uint256 manipulatedAmount = amount; // Adjust the amount as needed
        // Example: perform a swap in the Uniswap V3 pool to shift the price
        // uniswapPool.swap(amount);
    }
}

Summary of PoC Execution:
The attacker monitors the liquidation transaction and executes a manipulation of the price oracle to influence the outcome.
The attacker ensures that their transaction is executed before the liquidation, either by paying higher gas fees or strategically timing their actions.
The liquidation is executed at an unfavorable price for the borrower, while the attacker profits from acquiring the collateral at a manipulated price.

Mitigation

Possible Mitigation:
Commit-Reveal Mechanism: Implementing a commit-reveal mechanism can prevent the attacker from knowing the details of the liquidation transaction ahead of time.
Time-Based Locks: Enforcing a time lock on liquidation transactions can prevent attackers from front-running liquidations by forcing a delay between the transaction creation and execution.
Increase Transaction Finality: Increasing the transaction finality or using more robust price oracles (e.g., multi-source oracles) can mitigate the effect of manipulation.