Open c4-bot-1 opened 7 months ago
Picodes marked the issue as duplicate of #965
Picodes changed the severity to QA (Quality Assurance)
Could you take another look at this? The primary report fails to grasp the true impact:
Thank you
@0xCiphky thanks for your comment.
I still don't get what the fundamental error would be.
LPs of the unwhitelisted pool aren't earning anymore from arbitrages as desired, and the fact that the pool could still lead to arbitrages and be used isn't detrimental to anyone except the LPs of this pool who should leave. In addition, it could lead to other LPs earning more as you are showing which would be a bonus.
Lines of code
https://github.com/code-423n4/2024-01-salty/blob/53516c2cdfdfacb662cdea6417c52f23c94d5b5b/src/pools/Pools.sol#L366 https://github.com/code-423n4/2024-01-salty/blob/53516c2cdfdfacb662cdea6417c52f23c94d5b5b/src/pools/Pools.sol#L382 https://github.com/code-423n4/2024-01-salty/blob/53516c2cdfdfacb662cdea6417c52f23c94d5b5b/src/pools/Pools.sol#L395 https://github.com/code-423n4/2024-01-salty/blob/53516c2cdfdfacb662cdea6417c52f23c94d5b5b/src/rewards/SaltRewards.sol#L117
Vulnerability details
Vulnerability Details:
The protocol implements a swap feature to allow users to swap one token for another via a direct whitelisted pool. The swap function also checks if profitable arbitrage is possible after the user swap that was just made and if there is it will perform it. This profit is then distributed to liquidity providers of the pools used in the arbitrage.
Currently the swap function has no checks to ensure only whitelisted tokens can be swapped, this isn’t a problem for random tokens as they would not have any current liquidity so the swap would fail. However, if a token has recently been voted off the whitelist by the DAO the pool will still have liquidity and a swap can be made even though it shouldn’t.
Impact:
Proof Of Concept
Tools Used:
Recommendation:
Limit all swaps to only whitelisted pools by adding a check to all function that can be used to perform a swap.
Assessed type
Invalid Validation