Floor aims to create a fully onchain governance mechanism for sweeping and deploying NFTs to profitable NFT-Fi strategies as well as seeding liquidity for its own NFT-Fi products.
The uniswap strategy calls the position manager element of uniswap's periphery contracts. This contract returns the current amount of liquidity and the amount of each token consumed by this deposit. The contract sets all three values into a positions mapping, and the positions mapping is decremented when a user withdraws. If two users deposit and the second one deposits only very small amount all withdraws are blocked of the first user's assets, because they would subtract a larger number from a smaller number in a checked arithmetic block. All previous deposits become unrecoverable.
Remediation Recommendation: Remove the positions mapping entirely. The values are not used and lesser impact version of this bug could take place as the pool shifted its token composition over time.
aleph-v
commented
1 year ago
The uniswap strategy calls the position manager element of uniswap's periphery contracts. This contract returns the current amount of liquidity and the amount of each token consumed by this deposit. The contract sets all three values into a positions mapping, and the positions mapping is decremented when a user withdraws. If two users deposit and the second one deposits only very small amount all withdraws are blocked of the first user's assets, because they would subtract a larger number from a smaller number in a checked arithmetic block. All previous deposits become unrecoverable.