You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on Mar 3, 2024. It is now read-only.
sherlock-admin opened this issue
Aug 29, 2023
· 0 comments
Labels
DuplicateA valid issue that is a duplicate of an issue with `Has Duplicates` labelHighA valid High severity issueRewardA payout will be made for this issue
LMPVaultRouterBase will charge a user 2x the deposit amount
Summary
If a user uses ETH to mint/deposit in LMPVaultRouterBase, it will pull 2x the deposit amount from the user, while supplying him with 1x the tokens.
Vulnerability Detail
When using ETH in LMPVaultRouter to mint or deposit (bolt are in LMPVaultRouterBase) it first pulls the ETH into the contract and then pulls the baseAsset (ex. WETH) with PeripheryPayments, where recipient is address(this) and from is msg.sender. However as you can see firstly ETH is pulled from this user and then WETH.
If the user is lacking in WETH the TX will revert
If he has enough WETH he will be charged twice for the same amount of tokens.
Impact
User is charged 2x if he uses ETH to funds the Vault.
sherlock-admin2
changed the title
Crazy Lace Nuthatch - LMPVaultRouterBase will charge a user 2x the deposit amount
0x3b - LMPVaultRouterBase will charge a user 2x the deposit amount
Oct 3, 2023
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Labels
DuplicateA valid issue that is a duplicate of an issue with `Has Duplicates` labelHighA valid High severity issueRewardA payout will be made for this issue
0x3b
high
LMPVaultRouterBase will charge a user 2x the deposit amount
Summary
If a user uses ETH to mint/deposit in LMPVaultRouterBase, it will pull 2x the deposit amount from the user, while supplying him with 1x the tokens.
Vulnerability Detail
When using ETH in LMPVaultRouter to mint or deposit (bolt are in LMPVaultRouterBase) it first pulls the ETH into the contract and then pulls the baseAsset (ex. WETH) with PeripheryPayments, where recipient is
address(this)
and from ismsg.sender
. However as you can see firstly ETH is pulled from this user and then WETH.Impact
User is charged 2x if he uses ETH to funds the Vault.
Code Snippet
https://github.com/sherlock-audit/2023-06-tokemak/blob/main/v2-core-audit-2023-07-14/src/vault/LMPVaultRouterBase.sol#L23-L57
Tool used
Manual Review
Recommendation
Either remove the ETH method or make it in a way so that it pull the WETH from the contract.
Duplicate of #1
The text was updated successfully, but these errors were encountered: