Closed code423n4 closed 2 years ago
No user should randomly transfer ETH the FeeBurner
contract. That is not part of standard functionality. If they do, they should expect to lose their ETH. And if someone else gets their ETH, that's better than it being stuck in the contract.
I have to agree with the sponsor that the contract is meant to be called with a msg.value, and for the sake of not wasting resources it checks the balance of token / ETH it has at the time of the call and it accredits it to the caller, this is very similar to how most periphery / router would work
I fail to see how the contract would receive free ETH and in lack of that argument, I don't believe there's any vulnerability here
Lines of code
https://github.com/code-423n4/2022-05-backd/blob/2a5664d35cde5b036074edef3c1369b984d10010/protocol/contracts/tokenomics/FeeBurner.sol#L35 https://github.com/code-423n4/2022-05-backd/blob/2a5664d35cde5b036074edef3c1369b984d10010/protocol/contracts/tokenomics/FeeBurner.sol#L82 https://github.com/code-423n4/2022-05-backd/blob/2a5664d35cde5b036074edef3c1369b984d10010/protocol/contracts/tokenomics/FeeBurner.sol#L102
Vulnerability details
Issue: _depositInPool uses address(this).balance
Consequences: exploiter will get more lp tokens
Proof of Concept