search

code-423n4 / 2021-07-spartan-findings

0 stars 0 forks source link

Can accidentally lose tokens when removing liquidity from pool #160

Closed code423n4 closed 3 years ago

code423n4 commented 3 years ago

Handle

cmichel

Vulnerability details

Vulnerability Details

The Pool.removeLiquidityExact function redeems liquidity tokens for underlying to the router contract in case of the token being the zero address. This works if the underlying token is actually WBNB but if the pool token is different and the user accidentally inserted 0 as the token address, the redeemed token will stay in the router.

Recommended Mitigation Steps

If token == 0 add a check for pool.token == WBNB such that it is ensured that the pool's token is actually WBNB.

verifyfirst commented 3 years ago

Pools are be design to allow other protocols to wrap with their own routers. Our router handles WBNB for its pool

SamusElderg commented 3 years ago

Have tested '0' as the input (this is a ROUTER function btw; not POOL) which causes the txn to fail as expected thereby deeming this a non-issue unless the warden can explain how to reproduce?

The return type for PoolFactory.getPool() is an address of which '0' or 0 is not; so it fails as intended.

ghoul-sol commented 3 years ago

Per sponsor comment, invalid.