You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on Jun 2, 2024. It is now read-only.
DuplicateA valid issue that is a duplicate of an issue with `Has Duplicates` labelMediumA valid Medium severity issueRewardA payout will be made for this issue
Incorrect slippage used for swapping SDT to CvgSdt tokens while claiming rewards
Summary
The logic for claiming CVG and SDT rewards through the claimCvgSdtRewards function in the SdtStakingPositionService contract allows specifying whether the claimed SDT tokens should be converted to CrvSDT tokens. The claimCvgSdtRewards function calls the SdtRewardReceiver's claimCvgSdtSimple function, where the conversion of SDT to CrvSDT tokens can be achieved either through minting at a 1:1 ratio or by using the Curve pool to exchange the SDT rewards for CrvSDT token
The swapping mechanism should only work if the returned amount in CvgSDT tokens is greater than the amount of rewards in SDT. This is also indicated in the comment in source code.
Vulnerability Detail
The pool's exchange function, used to calculate slippage as an expected value, relies on the result of the get_dy function, which returns the amount of tokens that would be obtained for the given input token amount.
(..)
ICrvPoolPlain _poolCvgSDT = poolCvgSDT;
/// @dev Only swap if the returned amount in CvgSdt is gretear than the amount rewarded in SDT
_poolCvgSDT.exchange(0, 1, rewardAmount, _poolCvgSDT.get_dy(0, 1, rewardAmount), receiver);
(..)
This means that the functionality does not work as expected and will perform swaps at the current rate, without any slippage protection, even in cases where the resulting amount of CvgSDT tokens is smaller than the input amount of SDT tokens.
Impact
The use of swapping SDT tokens to CvgSDT while claiming rewards is vulnerable to multiple exploitation scenarios:
An attacker might execute a sandwich attack against the user claiming rewards, as there is no slippage protection in place.
Users might lose portions of SDT tokens when swapping for CvgSDT since the exchange will be done at the current rate, even if it is highly unfavorable for the user.
It is recommended to use the expected parameter with the value of rewardAmount, which will correctly implement the intended logic. The swap will only succeed in cases where the amount of received CvgSDT is greater than the amount of rewarded SDT tokens.
sherlock-admin2
changed the title
Warm Tin Hamster - Incorrect slippage used for swapping SDT to CvgSdt tokens while claiming rewards
r0ck3tz - Incorrect slippage used for swapping SDT to CvgSdt tokens while claiming rewards
Dec 24, 2023
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Labels
DuplicateA valid issue that is a duplicate of an issue with `Has Duplicates` labelMediumA valid Medium severity issueRewardA payout will be made for this issue
r0ck3tz
medium
Incorrect slippage used for swapping
SDT
toCvgSdt
tokens while claiming rewardsSummary
The logic for claiming
CVG
andSDT
rewards through theclaimCvgSdtRewards
function in theSdtStakingPositionService
contract allows specifying whether the claimedSDT
tokens should be converted toCrvSDT
tokens. TheclaimCvgSdtRewards
function calls theSdtRewardReceiver
'sclaimCvgSdtSimple
function, where the conversion ofSDT
toCrvSDT
tokens can be achieved either through minting at a 1:1 ratio or by using the Curve pool to exchange theSDT
rewards forCrvSDT
tokenThe swapping mechanism should only work if the returned amount in
CvgSDT
tokens is greater than the amount of rewards inSDT
. This is also indicated in the comment in source code.Vulnerability Detail
The pool's
exchange
function, used to calculate slippage as an expected value, relies on the result of theget_dy
function, which returns the amount of tokens that would be obtained for the given input token amount.This means that the functionality does not work as expected and will perform swaps at the current rate, without any slippage protection, even in cases where the resulting amount of
CvgSDT
tokens is smaller than the input amount ofSDT
tokens.Impact
The use of swapping
SDT
tokens toCvgSDT
while claiming rewards is vulnerable to multiple exploitation scenarios:SDT
tokens when swapping forCvgSDT
since the exchange will be done at the current rate, even if it is highly unfavorable for the user.Code Snippet
Tool used
Manual Review
Recommendation
It is recommended to use the
expected
parameter with the value ofrewardAmount
, which will correctly implement the intended logic. The swap will only succeed in cases where the amount of receivedCvgSDT
is greater than the amount of rewardedSDT
tokens.Duplicate of #180
The text was updated successfully, but these errors were encountered: