Signature malleability in permit() and permitPositionManagerApproval()

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-badger/blob/f2f2e2cf9965a1020661d179af46cb49e993cb7e/packages/contracts/contracts/EBTCToken.sol#L199-L221
https://github.com/code-423n4/2023-10-badger/blob/f2f2e2cf9965a1020661d179af46cb49e993cb7e/packages/contracts/contracts/BorrowerOperations.sol#L706

Vulnerability details

Impact

Both permit() and permitPositionManagerApproval() are vulnerable to signature malleability, which allows replay attacks.

During the previous Code4rena contest, the similar attack vector has been evaluated as Medium/High

• [Medium] cancelSig will not completely cancel signatures due to malleability vulnerabilities 2023-07-nounsdao-findings#198
• [High] https://code4rena.com/reports/2021-04-meebits#h-01-signature-malleability-of-evms-ecrecover-in-verify

Based on that, I've decided to evaluate the risk of this issue as Medium. It's worth to note, that in most of the previous Code4rena contests, the signature malleability vulnerabilities had been detected during the bot race, so there weren't reported as a separate issue. Thus, there aren't many contests which could be used as a reference for proper severity categorization. In the current contest - the bot race did not report signature malleability issue, so I'm reporting it as a separate issue in this report.

Proof of Concept

• In BorrowerOperations.sol, there is a function permitPositionManagerApproval() which sets given _approval for specified _borrower and _positionManager

FIle: BorrowerOperations

address recoveredAddress = ecrecover(digest, v, r, s);

In EBTCToken.sol, there's a function permit(), which approves given amount for specified owner and spender.

File: EBTCToken.sol

 address recoveredAddress = ecrecover(digest, v, r, s);

In both cases, there's no verification of v, r, s parameters.

https://swcregistry.io/docs/SWC-117/

 The EVM specification defines several so-called ‘precompiled’ contracts one of them being ecrecover which executes the elliptic curve public key recovery. A malicious user can slightly modify the three values v, r and s to create other valid signatures.

Tools Used

Manual code review

Recommended Mitigation Steps

Consider using OpenZeppelin's ECDSA library: https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/utils/cryptography/ECDSA.sol

Assessed type

Invalid Validation

[bytes032]

https://gist.github.com/GalloDaSballo/a0f9766bf7bac391f49d2d167e947de0#permit-signatures-are-malleable

[c4-pre-sort]

bytes032 marked the issue as insufficient quality report

[c4-pre-sort]

bytes032 marked the issue as primary issue

[c4-sponsor]

GalloDaSballo (sponsor) disputed

[GalloDaSballo]

Known + we use nonces

[c4-judge]

jhsagd76 marked the issue as unsatisfactory:
Out of scope