Initial user setting minLpTokenAmount too low will lose funds

[code423n4]

Lines of code

https://github.com/code-423n4/2022-12-caviar/blob/0212f9dc3b6a418803dbfacda0e340e059b8aae2/src/Pair.sol#L426

Vulnerability details

Impact

In some protocols, a common vulnerability exists where the first depositor can be frontrun to have their entire initial deposit stolen (e.g. see code-423n4/2022-01-sherlock-findings#39). If the first user does not properly set the minLpTokenAmount in add function, they will be susceptible to this attack. For extra safety, you could consider minting some of the initial Math.sqrt(x * y) tokens from the first deposit to the zero address.

Proof of Concept

• The first depositor deposits x baseToken and y fractionalToken, and sets their min minLpTokenAmount too low.
• An attacker sees this tx in the mempool and deposits 1 wei of x and 1 wei of y. This makes the LP total supply 1. The attack also manually transfers x+1 and y+1 baseToken and fractionalToken directly to the pool contract.
• The first depositor tx will happen, which will round the number of LP tokens they receive down to zero (or perhaps some other low number depending on the attacker's manual transfer). If they didn't set minLpTokenAmount high enough, then this would be an issue.

Tools Used

Manual.

Recommended Mitigation Steps

Consider minting some of the initial shares minted to the zero address, so that an attacker can't do this attack.

[c4-judge]

berndartmueller marked the issue as duplicate of #442

[c4-judge]

berndartmueller changed the severity to 3 (High Risk)

[c4-judge]

berndartmueller marked the issue as satisfactory