code-423n4 / 2021-06-gro-findings

0 stars 1 forks source link

function withdrawToAdapter should be inluded in the interface and return withdrawal amount #116

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

pauliax

Vulnerability details

Impact

function withdrawToAdapter re-assigns the amount but does not use it anywhere later. The declaration of this function could be changed to return this value to indicate the actual withdrawal amount. Also, I think this function should be included in IVault interface as it is externally called.

Recommended Mitigation Steps

Make withdrawToAdapter return the amount that was withdrawn and also include this function in the IVault interface.

kitty-the-kat commented 3 years ago

Not sure of reasoning here, never called by another contract - also, any transfer event of the underlying token would be seen.

ghoul-sol commented 3 years ago

Reassigning the amount variable feels like unfinished business. Not sure why it's done, I'll keep this as gas optimization.