search

code-423n4 / 2021-07-spartan-findings

0 stars 0 forks source link

Can accidentally lose tokens when removing liquidity from pool 2 #161

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

cmichel

Vulnerability details

Vulnerability Details

The Pool.removeLiquiditySingle function redeems liquidity tokens for underlying to the router contract in case of the token being the zero address. This works if the underlying token is actually WBNB but if the pool token is different and the user accidentally inserted 0 as the token address, it tries to swap a zero-balance WBNB to BASE and the redeemed tokens are stuck.

Recommended Mitigation Steps

If token == 0 add a check for pool.token == WBNB such that it is ensured that the pool's token is actually WBNB.

verifyfirst commented 3 years ago

In theory this is correct, however, solidity validates function parameters to be legitimate and in this instance, 0 or "0" is not a valid address.

ghoul-sol commented 3 years ago

I'll keep the issue as it's technically correct.