You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on Mar 3, 2024. It is now read-only.
lemonmon - Too many assets may be pulled from the user when they deposit or mint into the LMPVault via LMPVaultRouterBase.mint() or LMPVaultRouterBase.deposit()#363
DuplicateA valid issue that is a duplicate of an issue with `Has Duplicates` labelHighA valid High severity issueRewardA payout will be made for this issue
Too many assets may be pulled from the user when they deposit or mint into the LMPVault via LMPVaultRouterBase.mint() or LMPVaultRouterBase.deposit()
Summary
LMPVaultRouterBase.mint() and LMPVaultRouterBase.deposit() both may pull too many assets from the user, if the user sends ETH via msg.value.
Vulnerability Detail
When a user is calling LMPVaultRouterBase.mint() or LMPVaultRouterBase.deposit() and they are sending ETH via msg.value, the protocol may pull too many assets from the user:
LMPVaultRouterBase._processEthIn() is called subsequently (line 51, line 30 LMPVaultRouterBase.sol), which deposits WETH for the LMPVaultRouter contract (line 120 LMPVaultRouterBase.sol) based on the msg.value which is the ETH the user sent to the contract.
Additionally PeripheryPayments.pullToken() gets called (line 54, line 34 LMPVaultRouterBase.sol), which transfers WETH from the user to the LMPVaultRouter contract, despite that the user already sent the necessary assets in ETH via msg.value.
Impact
The protocol might pull too many assets from the user due to this issue. First the protocol receives ETH via msg.value and then additionally the protocol also pulls WETH from the user, so that the user might have paid too many assets at the end.
A malicious actor may then steal these excess assets by calling PeripheryPayments.unwrapWETH9(), which unwraps all the WETH in the LMPVaultRouter and sends it to the recipient function parameter, so that the malicious actor receives the excess WETH assets from the victim user who depositted or minted before into the LMPVault via LMPVaultRouterBase.mint() or LMPVaultRouterBase.deposit() by sending ETH to the protocol via msg.value.
Consider adjusting LMPVaultRouterBase.mint() and LMPVaultRouterBase.deposit() to account for the ETH that the user sent via msg.value to the protocol, so that the protocol doesn't pull too many assets from the user.
sherlock-admin
changed the title
Perfect Dijon Leopard - Too many assets may be pulled from the user when they deposit or mint into the LMPVault via LMPVaultRouterBase.mint() or LMPVaultRouterBase.deposit()
lemonmon - Too many assets may be pulled from the user when they deposit or mint into the LMPVault via LMPVaultRouterBase.mint() or LMPVaultRouterBase.deposit()Oct 3, 2023
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Labels
DuplicateA valid issue that is a duplicate of an issue with `Has Duplicates` labelHighA valid High severity issueRewardA payout will be made for this issue
lemonmon
medium
Too many assets may be pulled from the user when they deposit or mint into the
LMPVault
viaLMPVaultRouterBase.mint()
orLMPVaultRouterBase.deposit()
Summary
LMPVaultRouterBase.mint()
andLMPVaultRouterBase.deposit()
both may pull too many assets from the user, if the user sends ETH viamsg.value
.Vulnerability Detail
When a user is calling
LMPVaultRouterBase.mint()
orLMPVaultRouterBase.deposit()
and they are sending ETH viamsg.value
, the protocol may pull too many assets from the user:LMPVaultRouterBase._processEthIn()
is called subsequently (line 51, line 30 LMPVaultRouterBase.sol), which deposits WETH for theLMPVaultRouter
contract (line 120 LMPVaultRouterBase.sol) based on themsg.value
which is the ETH the user sent to the contract.Additionally
PeripheryPayments.pullToken()
gets called (line 54, line 34 LMPVaultRouterBase.sol), which transfers WETH from the user to theLMPVaultRouter
contract, despite that the user already sent the necessary assets in ETH viamsg.value
.Impact
The protocol might pull too many assets from the user due to this issue. First the protocol receives ETH via
msg.value
and then additionally the protocol also pulls WETH from the user, so that the user might have paid too many assets at the end.A malicious actor may then steal these excess assets by calling
PeripheryPayments.unwrapWETH9()
, which unwraps all the WETH in theLMPVaultRouter
and sends it to therecipient
function parameter, so that the malicious actor receives the excess WETH assets from the victim user who depositted or minted before into theLMPVault
viaLMPVaultRouterBase.mint()
orLMPVaultRouterBase.deposit()
by sending ETH to the protocol viamsg.value
.Code Snippet
https://github.com/sherlock-audit/2023-06-tokemak/blob/main/v2-core-audit-2023-07-14/src/vault/LMPVaultRouterBase.sol#L44-L57
https://github.com/sherlock-audit/2023-06-tokemak/blob/main/v2-core-audit-2023-07-14/src/vault/LMPVaultRouterBase.sol#L23-L41
https://github.com/sherlock-audit/2023-06-tokemak/blob/main/v2-core-audit-2023-07-14/src/vault/LMPVaultRouterBase.sol#L111-L122
https://github.com/sherlock-audit/2023-06-tokemak/blob/main/v2-core-audit-2023-07-14/src/utils/PeripheryPayments.sol#L54-L56
https://github.com/sherlock-audit/2023-06-tokemak/blob/main/v2-core-audit-2023-07-14/src/utils/PeripheryPayments.sol#L39-L48
Tool used
Manual Review
Recommendation
Consider adjusting
LMPVaultRouterBase.mint()
andLMPVaultRouterBase.deposit()
to account for the ETH that the user sent viamsg.value
to the protocol, so that the protocol doesn't pull too many assets from the user.Duplicate of #1
The text was updated successfully, but these errors were encountered: