Curves token subject can add pausable/whitelisting functionality

[c4-bot-8]

Lines of code

https://github.com/code-423n4/2024-01-curves/blob/516aedb7b9a8d341d0d2666c23780d2bd8a9a600/contracts/Curves.sol#L236-L238

Vulnerability details

Impact

Fees are transferred using the _transferFees function when Curves tokens are bought or sold. Inside this function there is an external call to the subject address to transfer their fees. If the subject address is a contract containing a fallback or receive function they could control the market for their Curves token by adding functionality such as pausing or whitelisting.

Proof of Concept

https://github.com/code-423n4/2024-01-curves/blob/516aedb7b9a8d341d0d2666c23780d2bd8a9a600/contracts/Curves.sol#L236-L238

(bool success2, ) = curvesTokenSubject.call{value: subjectFee}("");
                if (!success2) revert CannotSendFunds();

Tools Used

Manual Review

Recommended Mitigation Steps

None

Assessed type

Other

[c4-pre-sort]

raymondfam marked the issue as insufficient quality report

[c4-pre-sort]

raymondfam marked the issue as duplicate of #1061

[c4-judge]

alcueca marked the issue as unsatisfactory: Invalid

[alcueca]

Belongs in analysis

[c4-judge]

alcueca marked the issue as unsatisfactory: Invalid

[c4-judge]

alcueca marked the issue as unsatisfactory: Invalid