search

code-423n4 / 2022-01-timeswap-findings

2 stars 0 forks source link

Asset and Collateral Should Not Be Same #182

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

defsec

Vulnerability details

Impact

During the code review, It has been observed that asset and collateral check is missing. On the timeswap pair, the checks are not implemented and that can cause misintended behaviours.

Proof of Concept

  1. Navigate to the following contract.

https://github.com/code-423n4/2022-01-timeswap/blob/main/Timeswap/Timeswap-V1-Core/contracts/TimeswapPair.sol#L265

  1. AssetTo and CollateralTo address is not checked if they are equals.

Tools Used

None

Recommended Mitigation Steps

Consider checking AssetTo and CollateralTo if they are same.

Mathepreneur commented 2 years ago

We want to give the caller (the owner of the bond and insurance tokens) the ability to transfer the asset ERC20 token and collateral ERC20 token to different addresses.

0xean commented 2 years ago

as designed, closing as invalid.