Closed c4-bot-10 closed 6 months ago
0xRobocop marked the issue as primary issue
0xRobocop marked the issue as insufficient quality report
0xRobocop marked the issue as remove high or low quality report
0xRobocop marked the issue as duplicate of #86
OpenCoreCH marked the issue as selected for report
OpenCoreCH marked the issue as not selected for report
OpenCoreCH marked the issue as satisfactory
OpenCoreCH marked issue #64 as primary and marked this issue as a duplicate of 64
OpenCoreCH marked the issue as not selected for report
OpenCoreCH marked the issue as selected for report
OpenCoreCH marked issue #86 as primary and marked this issue as a duplicate of 86
Lines of code
https://github.com/code-423n4/2024-02-hydradx/blob/main/HydraDX-node/pallets/stableswap/src/lib.rs#L584 https://github.com/code-423n4/2024-02-hydradx/blob/main/HydraDX-node/math/src/stableswap/math.rs#L160
Vulnerability details
Impact
The last LP in a stable swap pool can't remove all the liquidity or remove all his shares for an assest.
Proof of Concept
When an LP removes liquidity from a stable swap pool, we make sure the shares left are bigger than
MinPoolLiquidity
or equal to all the issued shares:However, this is actually impossible because we will fail in math functions calculating for assets. Especially, if an LP tries to remove all the shares, the calculation of
adjusted_d
incalculate_shares
will fail because not all reserves inadjusted_reserves
are zero.Let's try it in test
remove_liquidity_should_work_when_withdrawing_all_shares
by removing the Alice (the first and last LP) all shares:Then it will fail.
Tools Used
Manual Review.
Recommended Mitigation Steps
When an LP remove all the issued shared, we should send all the assets out and reset the pool.
Assessed type
Context