Tranche members can freely mint Tranche tokens and drain Escrow

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-09-centrifuge/blob/main/src/token/Tranche.sol#L72
https://github.com/code-423n4/2023-09-centrifuge/blob/main/src/LiquidityPool.sol#L231
https://github.com/code-423n4/2023-09-centrifuge/blob/main/src/InvestmentManager.sol#L148
https://github.com/code-423n4/2023-09-centrifuge/blob/main/src/InvestmentManager.sol#L255

Vulnerability details

Impact

Approved members of Tranche can mint Tranche tokens to themselves and drain the Escrow.

Proof of Concept

mint() in Tranche.sol lacks access control for the caller. restricted modifier only enforces to is an approved member of the Tranche.

    function mint(address to, uint256 value) public override restricted(_msgSender(), to, value) {
        return super.mint(to, value);
    }

Consider following scenario:

1. A malicious user initiates a minimal investment in a Tranche, successfully becoming an approved member
2. Once user is approved, he can freely mint Tranche tokens to himself.
3. Subsequently, the user invokes the requestRedeem() function on the LiquidityPool contract.
4. requestRedeem() on InvestmentManager is triggered, and user supplies Tranche tokens.
5. User is able to receive payout at epoch execution incoming message handleExecutedCollectRedeem().

Add following PoC to Tranche.t.sol:

    function testMintTokenForApprovedMembers() public {

        address attacker = makeAddr("attacker");

        //@note: attacker investment steps have been omitted for clarity in this test.
        //Assume the attacker has invested the minimum amount through the appropriate channel.
        //Following the investment, the attacker is now an approved member.
        restrictionManager.updateMember(attacker, block.timestamp + 100);
        bool member = restrictionManager.hasMember(attacker);
        console.log(member);

        //User can freely mint Tranche Token
        token.mint(attacker, 10000);
        uint256 bal = token.balanceOf(attacker);
        assertEq(bal, 10000);
    }

Tools Used

Manual Review/Foundry

Recommended Mitigation Steps

-   function mint(address to, uint256 value) public override restricted(_msgSender(), to, value) {
+   function mint(address to, uint256 value) public override auth restricted(_msgSender(), to, value) {
        return super.mint(to, value);
    }

Assessed type

Invalid Validation

[c4-pre-sort]

raymondfam marked the issue as low quality report

[c4-pre-sort]

raymondfam marked the issue as duplicate of #14

[c4-judge]

gzeon-c4 marked the issue as duplicate of #779

[c4-judge]

gzeon-c4 changed the severity to 2 (Med Risk)

[c4-judge]

gzeon-c4 marked the issue as not a duplicate

[c4-judge]

gzeon-c4 marked the issue as unsatisfactory:
Invalid