code-423n4 / 2021-07-spartan-findings

0 stars 0 forks source link

[Pool] - Anyone can remove liquidity from Pools, allowing them to alter the price #206

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

a_delamo

Vulnerability details

Impact

On the Pool.sol, the function removeForMember is public. Allowing anyone to call the method using an address of an LP in order to remove liquidity from the pools and return to the LP account.

If we combine the ability to remove liquidity and being able to do flash loans, we can alter prices and extract value from the remaining LPs.

verifyfirst commented 3 years ago

removeForMember only works if a user sends lps to the pool contract and calls removeForMember. I.e Funds in = Funds out.

ghoul-sol commented 3 years ago

Per sponsor comment, making this invalid