code-423n4 / 2023-05-juicebox-findings

1 stars 1 forks source link

amount0Delta & amount1Delta on uniswapV3SwapCallback could be returns negative value #13

Closed code423n4 closed 1 year ago

code423n4 commented 1 year ago

Lines of code

https://github.com/code-423n4/2023-05-juicebox/blob/main/juice-buyback/contracts/JBXBuybackDelegate.sol#L216

Vulnerability details

Impact

amount0Delta & amount1Delta could uniswapV3SwapCallback could be returns negative value could lead to unexpected behavior on swap

Proof of Concept

Based on document of Uniswap: https://docs.uniswap.org/contracts/v3/reference/core/interfaces/callback/IUniswapV3SwapCallback

Tools Used

Manual Review

Recommended Mitigation Steps

Check & Handle Negative values

Assessed type

Uniswap

code423n4 commented 1 year ago

Withdrawn by Fanz