Official Ver 1.0.1 Change Logs

"If crypto succeeds, it’s not because it empowers better people, it’s because to empowers better institutions." - Vitalik Buterin

April 6th 2023

Owner: @0xBill.arb

Shared with: Max+ | Overnight.fi and alter+ | Overnight.fi

Status: Review

Published: April 12th 2023

Executive Summary

Impact: Risking losing deployer's hot private key would break Auragi completely.

Root cause: @0xBill.arb added setFee to tailor trading fee for our partner protocols.

function setFee(uint value) external {
    require(msg.sender == factory, "!factory");
    require(value >= MAX_FEE, "max");
    swapFee = value;
    emit FeesChanged(value);
}

Instead of:

function setFee(uint value) external {
    require(msg.sender == factory, "!factory");
    require(value <= MAX_FEE, "max");
    swapFee = value;
    emit FeesChanged(value);
}

In case that deployer's hot private key is compromised, the attacker can setFee to 100% so no one would swap on Auragi. This is a fatal risk!

Problem Summary

Duration of problem: 5 hours

Product(s) affected: PairFactory smart contract

User impact: None

Revenue impact: None

Detection: alter+ | Overnight.fi found the issue due to code due diligence before providing liquidity on Auragi:

Resolution:

Step 1: Deploy a Self Destruct smart contract to be FeeManager.

https://arbiscan.io/address/0xe73bc612c140F7E6481cBf2F871068712b1b8e19

Step 2: Deployer setFeeManager to the Self Destruct smart contract.

https://arbiscan.io/tx/0x6d028cfad610fdf27eac54c64c872110d23f8cc5c88e61a2535090eb10765024

Step 3: Call acceptPermission on the Self Destruct smart contract.

https://arbiscan.io/tx/0x497eff9120733a6fa6f77e832c694f488551c2888c7306bd35129afa19c900fb

Impact: No longer able to setFee for protocols if requested.

User impact: The trading fees are always: 0.01% for stable pools and 0.05% for volatile pools. Trading fees will never change.

Revenue impact: None

Lessons Learned

Things that went well

• Overnight.fi team identified a critical risk for us.

• Auragi team quickly fixed the issue with self destruct smart contract.

Things that went poorly

• Our unit-tests did not cover this case.

• Our Testnet also did not test setFee.

Where we got lucky

• Our deployer private key is a hot key so discovering and fixing this issue early is very lucky for us. If compromised, it would have been fatal for Auragi.

Action Items

Action Item	Type	Priority	Status
Deploy self destruct smart contract	mitigate	P1	Done
Code review	detect	P2	Done
Add unit-tests	prevent	P2	Done
Bug bounty	detect	P3	TODO(@0xBill.arb)