Joy Ayitey CharaD7

ENS ens-metadata-service avatar/header self-referential redirect loop (DoS on metadata.ens.domains)

Full write-up: REPORT_AVATAR_SELFREF.md

Files

REPORT_AVATAR_SELFREF.md - full bug report (root cause, attack chain, impact, novelty, references)
ens-avatar-selfref-poc.js - PoC 1: reproduces the loop on current master (51x amplification)
ens-avatar-selfref-poc-survives197.js - PoC 2: novelty proof that the loop SURVIVES the open fix PR #197
package.json - pinned deps (node-fetch@2.7.0, ssrf-req-filter@1.1.1, timeout-signal@2.0.0)

MonoCooler - setTreasuryBorrower permissionless before initialization (uninitialized-role take-over; latent critical)

Report

Verified against the deployed source and a fork-Foundry PoC. The MonoCooler constructor never sets treasuryBorrower, and the setter is guarded only by if (treasuryBorrower != address(0) && !_isAdmin(msg.sender)) revert. Because a fresh deploy has treasuryBorrower == address(0), the guard short-circuits, so the FIRST caller can point the Cooler at an arbitrary ICoolerTreasuryBorrower and gain control of borrow() / repay() / writeOffDebt().

Severity note: the CURRENTLY-DEPLOYED MonoCooler (0xdb59...e7cc) is already initialized, so this is NOT exploitable on the

Lido CSM -- No-Access-Control Oracle Frame Configuration Manipulation

Brief/Intro

TwoPhaseFrameConfigUpdate in lidofinance/community-staking-module has two external functions, executeOffsetPhase() and executeRestorePhase(), with zero access control. Anyone can call them to manipulate the Lido Oracle's frame configuration or permanently renounce MANAGE_FRAME_CONFIG_ROLE on HashConsensus. If exploited in production, an attacker could halt the oracle, disrupt governance voting, and permanently freeze the protocol's ability to adjust oracle parameters.

Vulnerability Details

TwoPhaseFrameConfigUpdate is a helper contract that adjusts the Lido Oracle's frame configuration (epochs per frame, fast lane length) via a two-phase process:

	// SPDX-License-Identifier: AGPL-3.0
	pragma solidity ^0.8.20;

	import {Test, console2} from "forge-std/Test.sol";

	/// Minimal, faithful reproduction of the DEPLOYED Aave RewardsDistributor index math
	/// (aave-v3-periphery RewardsDistributor, mainnet INCENTIVES_IMPL 0x0ee554F6, Sourcify
	/// exact-match verified). The deployed _getAssetIndex is:
	/// firstTerm = emissionPerSecond * timeDelta * assetUnit / totalSupply
	/// newIndex = firstTerm + oldIndex

	// SPDX-License-Identifier: MIT
	pragma solidity ^0.8.27;

	import { IDisputeManager } from "@graphprotocol/interfaces/contracts/subgraph-service/IDisputeManager.sol";
	import { DisputeManagerTest } from "./DisputeManager.t.sol";

	/**
	* PoC: Indexer permanently shields a fault from ever being disputed.
	*
	* Indexing dispute ID = keccak256(abi.encodePacked(allocationId, poi, blockNumber)).

	// PoC: ens-metadata-service avatar/header image fetch can be turned into a
	// self-referential request-amplification loop (DoS on metadata.ens.domains).
	//
	// Chain (all verified against the repo + the exact npm deps it pins):
	// 1. Attacker owns a name and sets its avatar text record to
	// https://attacker.example/redir, where /redir 302-redirects to
	// https://metadata.ens.domains/mainnet/avatar/<attacker-name>.
	// 2. A victim (anyone, including another app that renders avatars) requests
	// https://metadata.ens.domains/mainnet/avatar/<attacker-name>.
	// 3. src/service/avatar.ts:107-115 calls abortableFetch(avatarURI). That is

	// SPDX-License-Identifier: MIT
	pragma solidity ^0.8.27;

	//
	// TermMax / Term Structure Labs -- High: theft of unclaimed yield
	// ===============================================================
	// Contract : contracts/v2/tokens/StableERC4626ForAave.sol (TermMax V2)
	// Bug : burnToAToken() burns `amount` shares but pays `amount` AAVE aTokens (raw,
	// index-unadjusted), while totalAssets() is pinned to totalSupply() (1:1) and the
	// Aave interest is quarantined as owner-milked income.

	// SPDX-License-Identifier: MIT
	pragma solidity ^0.8.27;

	//
	// TermMax / Term Structure Labs -- INVESTIGATION (NULL RESULT). Do NOT submit.
	// ========================================================================
	// Candidate : Protocol insolvency via bad debt never written down to totalAssets()
	// Contract : contracts/v2/vault/TermMaxVaultV2.sol + contracts/v2/vault/OrderManagerV2.sol
	// Result : The accounting asymmetry is REAL, but the end-to-end insolvency / depositor
	// theft DOES NOT REPRODUCE. The vault remains solvent. => Medium, not CRIT/HIGH.

	// SPDX-License-Identifier: MIT
	pragma solidity ^0.8.20;

	import { Test } from "forge-std/Test.sol";
	import { WeEthAbi } from "../src/WeEthAbi.sol";

	/// @notice Live mainnet-fork proof of the per-rail rate-limit DoS on the
	/// deployed L1 weETH OFT adapter (EtherFiOFTAdapterUpgradeable).
	/// Rail L1->BNB (eid 30102): limit 20 weETH / 14400s, observed live.
	contract RailDoSTest is Test {

	// SPDX-License-Identifier: GPL-3.0
	pragma solidity 0.8.33;

	// Lido CSM -- Low Severity: FeeOracle.finalizeUpgradeV3 Missing Access Control
	// Target: src/FeeOracle.sol (finalizeUpgradeV3)
	// Severity: Low \| Program: Lido Immunefi \| Primacy of Rules \| No KYC
	// ChainScope: 871 nodes, 2351 edges, 0 extractor failures, 100% confidence

	// The vulnerable function in FeeOracle.sol:
	//