Lack of White-listed Pool Check

[code423n4]

Handle

defsec

Vulnerability details

Impact

On the TridentRouter.sol, the whitelisting mechanism has been implemented on the contract. However, some of swap operations do not have pool white-listing check.

Proof of Concept

1. Navigate to "https://github.com/sushiswap/trident/blob/9130b10efaf9c653d74dc7a65bde788ec4b354b5/contracts/TridentRouter.sol" contract.
2. Go to Line #44 and #103.

Line #44

    function exactInputSingle(ExactInputSingleParams calldata params) public payable returns (uint256 amountOut) {
        // @dev Prefund the pool with token A.
        bento.transfer(params.tokenIn, msg.sender, params.pool, params.amountIn);
        // @dev Trigger the swap in the pool.
        amountOut = IPool(params.pool).swap(params.data);
        // @dev Ensure that the slippage wasn't too much. This assumes that the pool is honest.
        require(amountOut >= params.amountOutMinimum, "TOO_LITTLE_RECEIVED");
    }

Line #103

    function exactInputSingleWithNativeToken(ExactInputSingleParams calldata params) public payable returns (uint256 amountOut) {
        // @dev Deposits the native ERC-20 token from the user into the pool's `bento`.
        _depositToBentoBox(params.tokenIn, params.pool, params.amountIn);
        // @dev Trigger the swap in the pool.
        amountOut = IPool(params.pool).swap(params.data);
        // @dev Ensure that the slippage wasn't too much. This assumes that the pool is honest.
        require(amountOut >= params.amountOutMinimum, "TOO_LITTLE_RECEIVED");
    }

3. White-listed pools are not checked on the contract.

Tools Used

Manual Code Review

Recommended Mitigation Steps

Add white-listing check on the function. The sample code can be seen below.

isWhiteListed(params.pool);

[maxsam4]

Duplicate of https://github.com/code-423n4/2021-09-sushitrident-findings/issues/14