DOS if user chooses to specify minReturnedTokens
in the pay
function of the terminal
#101
Labels
2 (Med Risk)
Assets not at direct risk, but function/availability of the protocol could be impacted or leak value
bug
Something isn't working
duplicate-232
satisfactory
satisfies C4 submission criteria; eligible for awards
Lines of code
https://github.com/code-423n4/2023-05-juicebox/blob/main/juice-buyback/contracts/JBXBuybackDelegate.sol#L166
https://github.com/jbx-protocol/juice-contracts-v3/blob/main/contracts/JBSingleTokenPaymentTerminalStore3_1.sol#L415
https://github.com/jbx-protocol/juice-contracts-v3/blob/main/contracts/abstract/JBPayoutRedemptionPaymentTerminal3_1.sol#L1493
Vulnerability details
Impact
If user specifies
minReturnedTokens
in thepay
function of the terminal andBuybackDelegate
will take the swap path, transaction will be reverted due to the failed conditionif (beneficiaryTokenCount < _minReturnedTokens) revert INADEQUATE_TOKEN_COUNT();
in the terminal.Proof of Concept
In the
BuybackDelegate
contract if swapping is a preferred method of the acquiring JBX tokens we return with aweight = 0
https://github.com/code-423n4/2023-05-juicebox/blob/main/juice-buyback/contracts/JBXBuybackDelegate.sol#L166
In the payment terminal store we also return early with a
tokenCount = 0
https://github.com/jbx-protocol/juice-contracts-v3/blob/main/contracts/JBSingleTokenPaymentTerminalStore3_1.sol#L414C1-L415
And finally in the payment terminal we compare
beneficiaryTokenCount < _minReturnedTokens
wherebeneficiaryTokenCount
is a variable which is set iftokenCount > 0
, in our casetokenCount = 0
thereforebeneficiaryTokenCount
will also be 0. This will result in failed transaction everytimeminReturnedTokens > 0
.Tools Used
Manual review
Recommended Mitigation Steps
Perhaps we can add another condition to the check
This will revert only if mint path was chosen and we don't use the
BuybackDelegate
. However there is a possibility that this solution will conflict with data sources other thanBuybackDelegate
.Assessed type
DoS
The text was updated successfully, but these errors were encountered: