search

code-423n4 / 2021-12-yetifinance-findings

0 stars 0 forks source link

Unused WJLP can't be simply unwrapped #138

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

Handle

kenzo

Vulnerability details

WJLP can only be unwrapped from the Active Pool or Stability Pool. A user who decided to wrap his JLP, but not use all of them in a trove, Wouldn't be able to just unwrap them.

Impact

Impaired functionality for users. Would have to incur fees for simple unwrapping.

Proof of Concept

The unwrap functionality is only available from unwrapFor function, and that function is only callable from AP or SP. (Code ref)

function unwrapFor(address _to, uint _amount) external override {
        _requireCallerIsAPorSP();

Recommended Mitigation Steps

Allow anybody to call the function. As it will burn the holder's WJLP, a user could only unwrap tokens that are not in use.

kingyetifinance commented 2 years ago

Added unwrap function