DexLyn Disclosed Report

https://github.com/DexlynLabs/CLMM_Dex/tree/a1bd65e84ceb354ea0fa6683d65a738700d82a63

Short Description

DexlynClmm/sources/pool.move allows a rewarder to emit using the pool's own asset store; a malicious authority can withdraw LP capital as "rewards".

Vulnerability Details

• initialize_rewarder accepts any reward asset, including the traded tokens (DexlynClmm/sources/pool.move:1321).

• sources/pool.move:2547-2559).

• collect_rewarder withdraws the caller-specified asset from the pool signer's vault but never decrements pool.asset_* counters (DexlynClmm/sources/pool.move:1091-1100, compare to fee withdrawal at DexlynClmm/sources/pool.move:900-918).

• A malicious rewarder authority can therefore emit rewards denominated in the pool asset and claim them, directly draining LP capital while accounting invariants mask the shortfall.

1. Test details:

   • Lets both an honest LP and the attacker add liquidity.
   • Calls clmm_router::update_rewarder_emission from the attacker without depositing extra rewards.
   • Fast-forwards time, then calls clmm_router::collect_rewarder for the attacker position.
   • Asserts the attacker's balance increases and the pool's primary store balance decreases by the same amount, proving a direct drain.

2. Run the test:

   aptos move test --package-dir DexlynClmm --skip-fetch-latest-git-deps
   

3. Observe rewarder_emission_exploit_test::test_rewarder_emission_drains_pool passes, demonstrating the exploit executes within the on-chain logic.

4. Logs:

newuser@LAPTOP-MLPJMQD2:~/CLMM_Dex$ aptos move test --package-dir DexlynClmm --skip-fetch-latest-git-deps
INCLUDING DEPENDENCY AptosStdlib
INCLUDING DEPENDENCY AptosToken
INCLUDING DEPENDENCY AptosTokenObjects
INCLUDING DEPENDENCY IntegerMate
INCLUDING DEPENDENCY MoveStdlib
INCLUDING DEPENDENCY SupraFramework
INCLUDING DEPENDENCY SupraStdlib
BUILDING DexlynClmm
warning: This assignment/binding to the left-hand-side variable `asset_b` is unused. Consider removing this assignment/binding, or prefixing the left-hand-side variable with an underscore (e.g., `_asset_b`), or renaming to `_`
    ┌─ DexlynClmm/tests/swap.t.move:818:23
    │
818 │         let asset_b = utils::coin_to_fa_address<TestCoinB>();
    │                       ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^

Running Move unit tests

Test result: OK. Total tests: 143; passed: 143; failed: 0
{
  "Result": "Success"
}