search

code-423n4 / 2021-09-sushitrident-findings

0 stars 0 forks source link

IndexPool's `flashswap` trasfer before callback #157

Closed code423n4 closed 3 years ago

code423n4 commented 3 years ago

Handle

0xsanson

Vulnerability details

Impact

The flashswap function in IndexPool.sol doesn't fulfill its function. Indeed it should transfer tokens to the users before they need to pay back, but the transfer happens at the end:

...
ITridentCallee(msg.sender).tridentSwapCallback(context);
// @dev Check Trident router has sent `amountIn` for skim into pool.
unchecked { // @dev This is safe from under/overflow - only logged amounts handled.
    require(_balance(tokenIn) >= amountIn + inRecord.reserve, "NOT_RECEIVED");
    inRecord.reserve += uint120(amountIn);
    outRecord.reserve -= uint120(amountOut);
}
_transfer(tokenOut, amountOut, recipient, unwrapBento);
...

Recommended Mitigation Steps

Move _transfer before the callback.

alcueca commented 3 years ago

Duplicate of #26