Closed code423n4 closed 2 years ago
Compound returns 0 on success and other numbers to indicate their error messages
https://github.com/code-423n4/2022-07-swivel/blob/main/Swivel/Swivel.sol#L709
Verified in the Compound documentation (https://compound.finance/docs/ctokens#mint); therefore, I am marking this as invalid given the sponsor's implementation seems correct and the warden's argument wrong.
Lines of code
https://github.com/code-423n4/2022-07-swivel/blob/main/Swivel/Swivel.sol#L585 https://github.com/code-423n4/2022-07-swivel/blob/main/Swivel/Swivel.sol#L709
Vulnerability details
Impact
When calling Swivel.splitUnderlying(), if the p enum is Compound protocol, then most times, the return value might be false when
ICompound(c).mint(a)
returns uint256 value greater than 0. With the return value being false, splitUnderlying() would revert with error 'deposit failed', making the user unable to split Compound token and mint.Proof of Concept
if (p == uint8(Protocols.Compound))
is satisfied, andICompound(c).mint(a)
returns amount greater than zerodeposit failed
.Tools Used
Manual review
Recommended Mitigation Steps
The if-statement may need to be changed appropriately.