087.md

Small Shamrock Rook

Medium

There is no max decrease in buy_fee_PID, allowing it to be manipulated easily

Summary

In updateBuyFeePID(), when the pid is to be increased, there is a maximum increase in the PID allowed per 4 hours:

if (((buy_fee_PID - buyPIDXhrAgo) > buyPID_incMaxRate)) {
    //does change exceed max rate over Xhrs?
    buy_fee_PID = buyPIDXhrAgo + buyPID_incMaxRate; //cap to max rate over 4hrs
}

Permalink to code: here

However this does not exist when decreasing the pid.

This allows the PID to be atomically decreased to zero, by repeatedly buying NUMA and then selling/burning it.

If buying X NUMA triggers the max PID increase:

Anyone can buy more than X NUMA, and then sell it. This will cause the buy_fee_PID to decrease upon the sell, by a greater amount than it had increased. Alternatively rather than selling they can also use the NUMA to mint a nuAsset to have the same effect on the buy_fee_PID.

Repeating this allows the PID to be decreased to zero, allowing for much cheaper vault buys of NUMA.

Root Cause

There is no maximum decrease in the PID

Internal pre-conditions

buyPID_incTriggerPct > buyPID_decTriggerPct is required

The protocol team has stated that this is a valid state

External pre-conditions

No response

Attack Path

No response

Impact

buy_fee_PID can be atomically manipulated

PoC

No response

Mitigation

Similar to the buyPID_incMaxRate, also enforce buyPID_decMaxRate