search

code-423n4 / 2022-06-notional-coop-findings

1 stars 1 forks source link

Funds can stuck in Contract #97

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Lines of code

https://github.com/code-423n4/2022-06-notional-coop/blob/main/notional-wrapped-fcash/contracts/wfCashLogic.sol#L298

Vulnerability details

Impact

_sendTokensToReceiver function is not checking that receiver is not the contract itself. If funds are sent to this contract then there is no way to withdraw them and they would get stuck in contract

Proof of Concept

  1. User A redeem his fCash position using redeem function and accidentally provides the contract address as receiver

  2. Contract receives the fund but now the fund is stuck with no way of withdrawal

Recommended Mitigation Steps

Make a new function which could allow Admin to withdraw any underlying/asset token if sent incorrectly to this contract.

jeffywu commented 2 years ago

Sounds reasonable.

gzeoneth commented 2 years ago

Downgrading to Low / QA.

gzeoneth commented 2 years ago

Consider with #96