emergencyTokenTransfer should exclude the xTokenAddress token (pWETH)

[code423n4]

Lines of code

https://github.com/code-423n4/2022-11-paraspace/blob/main/paraspace-core/contracts/ui/WETHGateway.sol#L196

Vulnerability details

Impact

The privileged owner could benefit from this to withraw pWETH token from WETHGateway contract and then redeem for ETH, which could result in the protocol insolvent.

Proof of Concept

pWETH token can be transfered to the WETHGateway contract from msg.sender by calling withdrawETHWithPermit or withdrawETH. pWETH token act as the redeem token for user to withdraw ETH from WETHGateway contract. The emergencyTokenTransfer function can be used to withdraw any ERC20 tokens stucked in the WETHGateway contract including the pWETH token.

    function emergencyTokenTransfer(
        address token,
        address to,
        uint256 amount
    ) external onlyOwner {
        IERC20(token).safeTransfer(to, amount);
        emit EmergencyTokenTransfer(token, to, amount);
    }

The privileged owner could benefit from this to withraw pWETH token from WETHGateway contract and then redeem for ETH, which could result in the protocol insolvent.

Tools Used

manual review

Recommended Mitigation Steps

Exclude the pWETH token in the emergencyTokenTransfer function.

    function emergencyTokenTransfer(
        address token, // @audit-issue should exculde xTokenAddress
        address to,
        uint256 amount
    ) external onlyOwner {
        require(token != IPool(pool).getReserveData(address(WETH)).xTokenAddress, "xTokenAddress");
        IERC20(token).safeTransfer(to, amount);
        emit EmergencyTokenTransfer(token, to, amount);
    }

[c4-judge]

dmvt marked the issue as duplicate of #54

[c4-judge]

dmvt marked the issue as satisfactory

[c4-judge]

dmvt marked the issue as unsatisfactory:
Out of scope