You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on Mar 3, 2024. It is now read-only.
sherlock-admin opened this issue
Aug 30, 2023
· 0 comments
Labels
DuplicateA valid issue that is a duplicate of an issue with `Has Duplicates` labelHighA valid High severity issueRewardA payout will be made for this issue
There is a common case: most users who frequently interact with UnsiwapRouter will approve some tokens to UnsiwapRouter (token.approve(router, someBigAmount)).
For the sake of brevity, here we only analyze deposit, and mint is similar.
File: v2-core-audit-2023-07-14\src\vault\LMPVaultRouterBase.sol
44: function deposit(
45: ILMPVault vault,
46: addressto,
47: uint256amount,
48: uint256minSharesOut49: ) publicpayablevirtualoverridereturns (uint256sharesOut) {
50: // handle possible eth51:->_processEthIn(vault);
52:
53: IERC20 vaultAsset =IERC20(vault.asset());
54:->pullToken(vaultAsset, amount, address(this));//@audit vaultAsset.safeTransferFrom(msg.sender, this, amount);55:
56: return_deposit(vault, to, amount, minSharesOut);
57: }
......
111: function _processEthIn(ILMPVault vault) internal {
112: // if any eth sent, wrap it first113: if (msg.value>0) {
114: // if asset is not weth, revert115: if (address(vault.asset()) !=address(weth9)) {
116: revertInvalidAsset();
117: }
118:
119: // wrap eth120:-> weth9.deposit{ value: msg.value }();
121: }
122: }
L51, if msg.value > 0, _processEthIn(vault) will wrap Ether to WETH.
L54, pullToken will transfer from the caller to WETH to the router.
If msg.value = 0, this is no problem.
If msg.value = amount, then the caller's WETH will be silently transferred to the router. This is equivalent to the caller consuming amount*2 funds, but the amount is left in the router. As a result, anyone who notices this can steal WETH via the following function:
sherlock-admin2
changed the title
Wobbly Sapphire Walrus - LMPVaultRouterBase.mint/deposit will make the user's weth be stolen in some cases
nobody2018 - LMPVaultRouterBase.mint/deposit will make the user's weth be stolen in some cases
Oct 3, 2023
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Labels
DuplicateA valid issue that is a duplicate of an issue with `Has Duplicates` labelHighA valid High severity issueRewardA payout will be made for this issue
nobody2018
medium
LMPVaultRouterBase.mint/deposit will make the user's weth be stolen in some cases
Summary
LMPVault.asset()
is baseAsset(WETH). mint/deposit can send native token (ether) in exchange for vault shares due to thepayable
modifier. They all call [_processEthIn](https://github.com/sherlock-audit/2023-06-tokemak/blob/main/v2-core-audit-2023-07-14/src/vault/LMPVaultRouterBase.sol#L111-L122) internally to wrap Ether to WETH, and then call [pullToken](https://github.com/sherlock-audit/2023-06-tokemak/blob/main/v2-core-audit-2023-07-14/src/utils/PeripheryPayments.sol#L54-L56) to transfer WETH from the caller to the router.There is a common case: most users who frequently interact with UnsiwapRouter will approve some tokens to UnsiwapRouter (token.approve(router, someBigAmount)).
If the user has approved WETH to LMPVaultRouter before and wants to use native token to call
mint
/deposit
, this may cause the sent native token to be stuck in the contract (wrapped as WETH). Anyone can steal WETH through [LMPVaultRouter.sweepToken](https://github.com/sherlock-audit/2023-06-tokemak/blob/main/v2-core-audit-2023-07-14/src/utils/PeripheryPayments.sol#L58-L65) (inherited from PeripheryPayments).Vulnerability Detail
For the sake of brevity, here we only analyze
deposit
, andmint
is similar.L51, if msg.value > 0,
_processEthIn(vault)
will wrap Ether to WETH.L54,
pullToken
will transfer from the caller to WETH to the router.If
msg.value = 0
, this is no problem.If
msg.value = amount
, then the caller's WETH will be silently transferred to the router. This is equivalent to the caller consumingamount*2
funds, but theamount
is left in the router. As a result, anyone who notices this can steal WETH via the following function:Impact
In the above case, the user's WETH may be quietly sent to the router, resulting in a loss of funds.
Code Snippet
https://github.com/sherlock-audit/2023-06-tokemak/blob/main/v2-core-audit-2023-07-14/src/vault/LMPVaultRouterBase.sol#L23-L57
Tool used
Manual Review
Recommendation
Whether
pullToken(vaultAsset, assets, address(this))
is called depends onmsg.value
:msg.value == 0
, then call it.msg.value > 0
, then do not call it, and check whethermsg.value
is equal to the required amount of baseAsset.Duplicate of #1
The text was updated successfully, but these errors were encountered: