Closed c4-bot-4 closed 6 months ago
PoC is passing 0 as slippage.
0xRobocop marked the issue as insufficient quality report
This can be controlled by the user by setting min_buy_amount
, setting it to 0 means they are fine with 0 tokens.
OpenCoreCH marked the issue as unsatisfactory: Invalid
Lines of code
https://github.com/code-423n4/2024-02-hydradx/blob/603187123a20e0cb8a7ea85c6a6d718429caad8d/HydraDX-node/pallets/stableswap/src/lib.rs#L717
Vulnerability details
Impact
AMMs shouldn't allow for swap operations that would result in users losing all their tokens and receiving 0 tokens in return. This could be exploited by attackers in combination with front running and MEV Bots to steal value from traders.
Proof of Concept
In the
buy()
andsell()
methods, there is no validation that the amount_out is non-zero. For a user to receive 0 tokens after asell()
operation, the liquidity of at least 1 token needs to be really low, so that the amount_out would get rounded to zero. Achieving this is possible either by withdrawing all the liquidity of one token in the pool and leaving a really small amount. The method that we are going to use in the proof of concept is to simply donate 1 unit of each Token to the pool, and provide liquidity to a single token type, TokenB, using the attacker's account, Bob, in order to hold the majority of shares of the pool and front-run thesell()
operation from User Alice of TokenB for Token A. With this, Bob would take all the tokens of Alice and Alice would get nothing in return. To run the coded Proof of Concept, add the following code topallets/stableswap/src/tests/add_liquidity.rs
Result:
Tools Used
Manual Review, Substrate
Recommended Mitigation Steps
To mitigate this issue, the
sell()
method should implement a zero-value check to validate that the user would get an amount of tokens after a swap operation. This could be implemented in 2 ways:Assessed type
Invalid Validation