You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on Mar 3, 2024. It is now read-only.
DuplicateA valid issue that is a duplicate of an issue with `Has Duplicates` labelHighA valid High severity issueRewardA payout will be made for this issue
LMPVaultRouterBase would still pull WETH token after processing ETH in
Summary
LMPVaultRouter inherits LMPVaultRouterBase and base asset is WETH. The mint and deposit functions are meant to work with either ETH or WETH. It ought to accept ETH and convert to WETH if user sends ETH (msg.value > 0). However, in this scenario, it would also pull WETH token.
Vulnerability Detail
As can be seen in the codebase, mint and deposit function would call _processEthIn and pullToken. _processEthIn would convert ETH to ERC20 WETH if msg.value > 0, while pullToken would transfer WETH from user address.
If users use WETH only, everything is fine. However, the contract is created so users have the choice to use ETH (instead of WETH). If such user send msg.value==amount and have WETH balance >= amount. The router would take both ETH and WETH while utilizing just the WETH. This would result in loss of asset to users. If they don't have WETH balance >= amount, the transaction would revert and thereby breaking a core feature.
sherlock-admin
changed the title
Tangy Honeysuckle Dragonfly - LMPVaultRouterBase would still pull WETH token after processing ETH in
0x007 - LMPVaultRouterBase would still pull WETH token after processing ETH in
Oct 3, 2023
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Labels
DuplicateA valid issue that is a duplicate of an issue with `Has Duplicates` labelHighA valid High severity issueRewardA payout will be made for this issue
0x007
high
LMPVaultRouterBase would still pull WETH token after processing ETH in
Summary
LMPVaultRouter
inheritsLMPVaultRouterBase
and base asset is WETH. Themint
anddeposit
functions are meant to work with either ETH or WETH. It ought to accept ETH and convert to WETH if user sends ETH (msg.value > 0). However, in this scenario, it would also pull WETH token.Vulnerability Detail
As can be seen in the codebase,
mint
anddeposit
function would call_processEthIn
andpullToken
._processEthIn
would convert ETH to ERC20 WETH if msg.value > 0, whilepullToken
would transfer WETH from user address.If users use WETH only, everything is fine. However, the contract is created so users have the choice to use ETH (instead of WETH). If such user send msg.value==amount and have WETH balance >= amount. The router would take both ETH and WETH while utilizing just the WETH. This would result in loss of asset to users. If they don't have WETH balance >= amount, the transaction would revert and thereby breaking a core feature.
POC
msg.value==amount==5ETH
5 ETH
to5 WETH
in_processEthIn
5 WETH
from the user inpullToken
10 WETH
in total5 WETH
to vault5 ETH
Impact
Users will either lose their ETH or be unable to perform deposit with ETH.
Code Snippet
https://github.com/sherlock-audit/2023-06-tokemak/blob/main/v2-core-audit-2023-07-14/src/vault/LMPVaultRouterBase.sol#L22-L57
https://github.com/sherlock-audit/2023-06-tokemak/blob/main/v2-core-audit-2023-07-14/src/vault/LMPVaultRouterBase.sol#L111-L122
https://github.com/sherlock-audit/2023-06-tokemak/blob/main/v2-core-audit-2023-07-14/src/utils/PeripheryPayments.sol#L54-L56
Tool used
Manual Review
Recommendation
if msg.value > 0, don't pull token. Either process eth or pull weth, but don't do both. Also update tests to include ETH mint and deposit.
Duplicate of #1
The text was updated successfully, but these errors were encountered: