search

code-423n4 / 2021-12-amun-findings

0 stars 0 forks source link

Tokens can be sent directly #265

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

pauliax

Vulnerability details

Impact

Token join contracts check that the final outputAmount is equal to _joinTokenStruct.outputAmount:

  uint256 outputAmount = outputToken.balanceOf(address(this));
  require(
      outputAmount == _joinTokenStruct.outputAmount,
      "FAILED_OUTPUT_AMOUNT"
  );

While these contracts are only for convenience, a theoretical attack exists here: a malicious actor can monitor the mempool and send the smallest fraction of the output token (basket) directly to the contract thus breaking this check.

Recommended Mitigation Steps

Consider replacing == with >= .

loki-sama commented 2 years ago

duplicate #81