Loopring / protocols

A zkRollup DEX & Payment Protocol
https://loopring.org
320 stars 119 forks source link

A contract bug #2708

Open chenlaoyao0523 opened 11 months ago

chenlaoyao0523 commented 11 months ago

protocols/packages/loopring_v3/contracts/core/impl/libexchange/ExchangeDeposits.sol // Add the amount to the deposit request and reset the time the operator has to process it ExchangeData.Deposit memory _deposit = S.pendingDeposits[to][tokenID]; _deposit.timestamp = uint64(block.timestamp); _deposit.amount = _deposit.amount.add(_amount); S.pendingDeposits[to][tokenID] = _deposit; If Loopring acts evil, does not recharge the user, and recharges the user with a small amount every once in a while, the user's recharge will not be redeemable. This is a serious trust issue.