Open code423n4 opened 2 years ago
StakingLPVaultHelpers.sol
should be used only with vault that use Curve LP token (so we could rename it)StakingLPVaultHelpers.sol
PoolCoinAmount comes from the storage of the calling operator, so only a Nested administrator can provide a poolCoinAmount Quality assurance is confirmed for the verification that poolCoinAmount is greater than 1
Nested Factory does not hold funds
Unlimited allowance is very dangerous
Nested finance use unlimited allowance in all contract that sent some token
contracts/libraries/ExchangeHelpers.sol
contracts/mocks/DummyRouter.sol
contracts/libraries/StakingLPVaultHelpers.sol
contracts/operators/Beefy/lp/BeefyZapBiswapLPVaultOperator.sol
contracts/operators/Beefy/lp/BeefyZapUniswapLPVaultOperator.sol
contracts/operators/Paraswap/ParaswapOperator.sol
contracts/operators/Beefy/BeefyVaultOperator.sol
contracts/operators/Yearn/YearnCurveVaultOperator.sol
contracts/NestedFactory.sol
If a contract that has max allowance is malicious, it may steal all tokens in the allowing contract. For example, if feeSplitter is malicious, it may steal all tokens in NestedFactory
poolCoinAmount validation
https://github.com/code-423n4/2022-06-nested/blob/b4a153c943d54755711a2f7b80cbbf3a5bb49d76/contracts/libraries/StakingLPVaultHelpers.sol
poolCoinAmount must be 2, 3, 4 so, if it not fall in this range it should be reverted but now it doesn't
On every functions in this file add
Change code to
@openzeppelin/contracts should be updated to ^4.4.2 as ^4.3.2 has many vulnerables
https://github.com/code-423n4/2022-06-nested/blob/main/package.json is using
@openzeppelin/contracts 4.3.2 has these vulnerabilities from https://snyk.io/vuln/npm:%40openzeppelin%2Fcontracts
You should update @openzeppelin/contracts to ^4.4.2 to avoid these vulnerabilities.