diamond-in/protocol-onyx

Enzyme Onyx Protocol - Bug Bounty Security Analysis

🎯 Quick Summary

This repository contains a comprehensive security analysis of the Enzyme Onyx Protocol as part of the Immunefi bug bounty program.

7 vulnerabilities have been identified, including:

• —⚠️ 1 CRITICAL - Inflation/Donation Attack
• —⚠️ 1 HIGH - Price Manipulation
• —⚠️ 3 MEDIUM - Various DOS and logic issues
• —⚠️ 2 LOW - Fee bypass and griefing

Estimated Total Bounty: $92,000 - $300,000

📋 Quick Links

🔥 Critical Findings

Vulnerability #1: Inflation/Donation Attack (CRITICAL)

Bounty Estimate: $50,000 - $200,000

An attacker can become the first depositor with 1 wei, donate large amounts to inflate share price, causing subsequent depositors to receive 0 shares due to rounding. The attacker then redeems their share, stealing victim funds.

POC: test/exploits/InflationAttack.t.sol

Impact: Direct theft of user funds

Vulnerability #2: Price Manipulation (HIGH)

Bounty Estimate: $20,000 - $50,000

Deposit and redeem requests have no slippage protection. Share price can change significantly between request and execution, allowing malicious admins or MEV bots to profit from users.

POC: test/exploits/PriceManipulation.t.sol

Impact: Temporary freezing of funds / Griefing

Vulnerability #3: Stale Rate DOS (MEDIUM)

Bounty Estimate: $10,000 - $20,000

If asset rate expires, all operations revert: deposits, redemptions, fee claims. Complete protocol lock until admin updates rates.

POC: test/exploits/StaleRateDOS.t.sol

Impact: Temporary freezing of funds

🚀 Quick Start

1. Install Foundry

curl -L https://foundry.paradigm.xyz | bash
foundryup

2. Run Tests

cd protocol-onyx

# Run all exploit POCs
forge test --match-path "test/exploits/*.sol" -vvv

# Or run individually
forge test --match-contract InflationAttack -vvv
forge test --match-contract PriceManipulation -vvv
forge test --match-contract StaleRateDOS -vvv

3. Test on Forked Network

# Set your RPC URL
export ETH_RPC_URL="https://eth-mainnet.g.alchemy.com/v2/YOUR_KEY"

# Run on fork
forge test --match-path "test/exploits/*.sol" --fork-url $ETH_RPC_URL -vvv

Note: Foundry installation required. See SETUP_AND_RUN.md for detailed instructions.

📊 Vulnerability Summary Table

📁 Repository Structure

.
├── README.md                           # This file
├── VULNERABILITY_REPORT.md             # Detailed vulnerability analysis
├── SETUP_AND_RUN.md                    # Setup and testing instructions
└── protocol-onyx/                      # Cloned Enzyme Onyx repository
    ├── src/                            # Protocol smart contracts
    │   ├── components/
    │   │   ├── fees/                   # Fee handling contracts
    │   │   ├── issuance/               # Deposit/redeem queues
    │   │   └── value/                  # Valuation contracts
    │   ├── shares/                     # Core Shares contract
    │   └── global/                     # Global state
    └── test/
        └── exploits/                   # 🔴 POC exploit tests
            ├── InflationAttack.t.sol
            ├── PriceManipulation.t.sol
            └── StaleRateDOS.t.sol

🎯 Affected Contracts

The following in-scope contracts contain vulnerabilities:

Critical Issues:

• —✅ ERC7540LikeDepositQueue.sol - Inflation attack vector
• —✅ Shares.sol - Acknowledged inflation risk
• —✅ ValuationHandler.sol - Share price calculation

High Issues:

• —✅ ERC7540LikeDepositQueue.sol - No slippage protection
• —✅ ERC7540LikeRedeemQueue.sol - No slippage protection

Medium Issues:

• —✅ ValuationHandler.sol - Stale rate DOS
• —✅ ContinuousFlatRateManagementFeeTracker.sol - Retroactive rate
• —✅ ERC7540LikeRedeemQueue.sol - Balance check

Low Issues:

• —✅ FeeHandler.sol - Rounding errors

🔬 Testing Details

Test Coverage

• —3 POC files with comprehensive attack scenarios
• —10+ test functions covering different attack vectors
• —Mitigation tests showing proposed fixes
• —Console logging for clear attack visualization

Example Test Output

=== INFLATION ATTACK POC ===

Step 1: Attacker deposits 1 wei as first depositor
Attacker receives shares: 1
Total supply after: 1

Step 2: Attacker donates 1,000,000 USDC to Shares contract
Donation amount: 1000000 USDC

Step 3: Share price after donation
Total value in contract: 1000000 USDC
Total shares: 1
Price per share: 1000000 USDC per share

Step 4: Victim deposits 10,000 USDC
Victim shares ACTUAL (after Solidity rounding): 0

=== VULNERABILITY CONFIRMED ===
Victim receives 0 shares but deposits 10,000 USDC
Attacker steals victim's funds through donation attack

🛡️ Recommended Fixes

Fix #1: Inflation Attack

// Require minimum first deposit
uint256 MIN_SHARES = 1e6;
require(netShares >= MIN_SHARES || totalSupply() >= MIN_SHARES, "Shares too low");

Fix #2: Price Manipulation

// Add slippage protection
struct DepositRequestInfo {
    address controller;
    uint40 canCancelTime;
    uint256 assetAmount;
    uint256 maxSharePrice;  // NEW
}

require(sharePriceInValueAsset <= request.maxSharePrice, "Slippage exceeded");

Fix #3: Stale Rate DOS

// Add grace period
uint256 GRACE_PERIOD = 1 days;

if (block.timestamp >= rateInfo.expiry + GRACE_PERIOD) {
    revert RateExpired();
} else if (block.timestamp >= rateInfo.expiry) {
    emit StaleRateWarning(_asset);
}

📈 Impact Assessment

Inflation Attack (CRITICAL)

• —Likelihood: High (easily exploitable on first deposit)
• —Impact: Critical (complete loss of user funds)
• —Affected Users: All depositors after attacker
• —Value at Risk: Unlimited

Price Manipulation (HIGH)

• —Likelihood: Medium (requires admin cooperation or MEV)
• —Impact: High (partial loss of funds)
• —Affected Users: Users with pending requests
• —Value at Risk: Depends on price swing

Stale Rate DOS (MEDIUM)

• —Likelihood: Low (admin error or unavailability)
• —Impact: Medium (temporary lock, no fund loss)
• —Affected Users: All users
• —Value at Risk: Opportunity cost

🔗 Resources

Enzyme Onyx

• —GitHub: https://github.com/enzymefinance/protocol-onyx
• —Commit: b98576fa39213b3c8aecb8b5b104c9acaa24eff0
• —Immunefi: https://immunefi.com/bug-bounty/enzyme-onyx/

Bug Bounty Program

• —Platform: Immunefi
• —Max Bounty: $200,000
• —Scope: 12 smart contracts
• —POC Required: Yes ✅

Development Tools

• —Foundry: https://book.getfoundry.sh/
• —Solidity: https://docs.soliditylang.org/

⚖️ Responsible Disclosure

DO ✅

• —Test on local or forked networks only
• —Report through Immunefi platform
• —Provide clear POCs and documentation
• —Suggest mitigations
• —Follow disclosure timeline

DON'T ❌

• —Exploit on live networks
• —Share publicly before fix
• —Attempt extortion
• —Manipulate real funds
• —Test without permission

📞 Contact & Support

Immunefi Submission

1. 1.Visit: https://immunefi.com/bug-bounty/enzyme-onyx/
2. 2.Click "Submit a Bug"
3. 3.Provide all documentation
4. 4.Wait for triage

Questions?

• —Immunefi Support: support@immunefi.com
• —Foundry Issues: https://github.com/foundry-rs/foundry/issues

📄 License

• —Security research: Educational purposes only
• —POC code: MIT License
• —Enzyme Onyx protocol: BUSL-1.1 License

✨ Acknowledgments

This security analysis was performed as part of the Immunefi bug bounty program. All vulnerabilities will be reported responsibly to allow the Enzyme team time to fix before public disclosure.

Analysis Date: October 13, 2025 Analyst: Security Researcher Program: Immunefi - Enzyme Onyx

🚨 Disclaimer

This repository is for security research and educational purposes only. Do not use this information to exploit live systems or harm users. All testing should be performed on local or forked test networks only.

Be ethical. Be responsible. Be rewarded. 🛡️