You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on Mar 3, 2024. It is now read-only.
sherlock-admin opened this issue
Aug 29, 2023
· 0 comments
Labels
DuplicateA valid issue that is a duplicate of an issue with `Has Duplicates` labelHighA valid High severity issueRewardA payout will be made for this issue
deposits with native ETH are not correctly handled in LMPVaultRouterBase
Summary
In LMPVaultRouterBase contract's mint and deposit functions contract is trying to pull WETH from user even though the user sends the required amount in native ETH.
The mint and deposit functions within the LMPVaultRouterBase contract are intended to manage deposits in both native ETH and WETH.
If a user provides a deposit in the form of native ETH to these functions, the _processEthIn() function converts this native ETH into WETH.
However, the router is attempting to pull WETH from the user once again, instead of utilizing the WETH that already exists within the router, which came from the conversion of the user's native ETH.
Impact
users can't use the native ETH for deposits.
Or double amount of funds will be taken from user if he also has WETH allowance to router.
Code Snippet
Proof Of Concept
function test_mint_with_native_eth() public {
address user =address(100);
vm.deal(user,10 ether);
// Making sure base asset of vault is WETHassertEq(lmpVault.asset(),WETH_MAINNET);
vm.startPrank(user);
vm.expectRevert("SafeERC20: low-level call failed");
// User trying to deposit to the vault using native ether
lmpVaultRouter.deposit{value: 5ether}(lmpVault,user,5 ether,0);
}
Tool used
Coverage Gutters and Manual Review
Recommendation
Don't pull WETH from the user when user is trying to deposit using native ETH
sherlock-admin2
changed the title
Sticky Malachite Rook - deposits with native ETH are not correctly handled in LMPVaultRouterBase
0xvj - deposits with native ETH are not correctly handled in LMPVaultRouterBase
Oct 3, 2023
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Labels
DuplicateA valid issue that is a duplicate of an issue with `Has Duplicates` labelHighA valid High severity issueRewardA payout will be made for this issue
0xvj
medium
deposits with native ETH are not correctly handled in LMPVaultRouterBase
Summary
In
LMPVaultRouterBase
contract'smint
anddeposit
functions contract is trying to pull WETH from user even though the user sends the required amount in native ETH.Lines of Code
https://github.com/Tokemak/v2-core-audit-2023-07-14/blob/62445b8ee3365611534c96aef189642b721693bf/src/vault/LMPVaultRouterBase.sol#L111-L122
https://github.com/Tokemak/v2-core-audit-2023-07-14/blob/62445b8ee3365611534c96aef189642b721693bf/src/vault/LMPVaultRouterBase.sol#L54
Vulnerability Detail
mint
anddeposit
functions within theLMPVaultRouterBase
contract are intended to manage deposits in both native ETH and WETH._processEthIn()
function converts this native ETH into WETH.Impact
Code Snippet
Proof Of Concept
Tool used
Coverage Gutters and Manual Review
Recommendation
Don't pull WETH from the user when user is trying to deposit using native ETH
Duplicate of #1
The text was updated successfully, but these errors were encountered: