search

brinc-finance / brinc-bugbounty

Brinc Bug Bounty Program
1 stars 0 forks source link

[FRONTEND] Buying of the wrong token #3

Open Rufia75 opened 3 years ago

Rufia75 commented 3 years ago

===========================================

      Thank you for your bug submission!
    Please fill out the information below.

===========================================

Bug Description: Went to buy BRQ with ETH. Ended up with DAI.

Expected Behaviour: Swap ETH for BRQ.

Actual Behaviour:** Chose ETH for BRQ swap. Approved. Sent transaction. Ended up with equivalent value of DAI.

Suspected Criticality Level: High

Steps to reproduce:**

  1. Choose ETH as selling currency and BRQ as buying currency.
  2. Approve.
  3. Complete transaction using dApp
  4. Check balance

System Information: Windows 10

Error Message: // any relevant error logs that may come from the EVM, browser, or etc.

Additional Info: https://rinkeby.etherscan.io/tx/0x0020c11279a415740985864fdf877c3fb34d315deb073668df7f1aa6bb4ce569

araskachoi commented 3 years ago

Hello, thank you for your submission! This is actually expected behaviour! Our reserve will only take DAI currently so any token that we have available for "conversion" will be always converted to DAI. So the steps are:

  1. you APPROVE the transaction which set the allowance amount of tokens you are able to spend
  2. you SWAP the token you wish to convert (in your case, ETH -> DAI)
  3. you complete the transaction by now minting BRQ with the DAI you have just swapped for.

So if you ever exit the buy flow after you have swapped your ETH to DAI, your balance will now have increased in DAI and decreased in ETH. BUT you have not completely purchased your BRQ. If you ever get kicked out of the buy flow, you can simply just reinitiate the buy order but use the DAI that you have recently received from a previous transaction you have tried to make.

Thank you again for helping Brinc become a better protocol and please follow up with any other questions!