Closed code423n4 closed 2 years ago
A few notes here:
fillZrxQuote
.Therefore, while it's possible to call this incorrectly sending ETH for a WETH swap, I don't believe it will result in fund loss.
Based on the 0x documentation I agree with the sponsor on the solution not working. Sponsor is encouraged to create a unit test to mimic this behavior and confirm that the asset flow is as expected.
Closing as proposed solution will not work with 0x specification.
Handle
WatchPug
Vulnerability details
https://github.com/code-423n4/2021-10-tally/blob/c585c214edb58486e0564cb53d87e4831959c08b/contracts/swap/Swap.sol#L106-L123
There is a potential mistake that can be made on the input data for
swapByQuote()
which uses the address ofWETH
aszrxSellTokenAddress
and send unwrapped ETH viamsg.value
.This is how the input data of the Uni v2 Router is formatted. Considering the popularity of Uni v2, it might be possible that some user or contract will call Tally's
Swap.sol
contract using calldata formatted in such a way.https://github.com/Uniswap/v2-periphery/blob/master/contracts/UniswapV2Router02.sol#L260-L263
PoC
Given:
Swap.sol
;When the caller calls
Swap.sol#swapByQuote()
withmsg.value
set to1e18
, andzrxSellTokenAddress
set toWETH
. The swap will go through and besides the 1 ether sent viamsg.value
, 1 WETH will be transferred from the caller to the contract mistakenly.The caller will suffer a fund loss of 1 WETH.
Recommendation
Change to: