According to the comments of the FundsTransferred event in SwappableYieldSource, the amount parameter is the number of funds transferred. However, in the _transferFunds function, the actual transferred amount is currentBalance, which should be provided as the event parameter instead.
PierrickGT
commented
3 years ago
Handle
shw
Vulnerability details
Impact
According to the comments of the
FundsTransferredevent inSwappableYieldSource, theamountparameter is the number of funds transferred. However, in the_transferFundsfunction, the actual transferred amount iscurrentBalance, which should be provided as the event parameter instead.Proof of Concept
Referenced code: SwappableYieldSource.sol#L288
Recommended Mitigation Steps
Change
_amountat line 288 tocurrentBalance.