Closed c4-bot-1 closed 6 months ago
Similar to #154
This one seems invalid. The user can burn all his shares as long there is a minimum overall amount of shares.
0xRobocop marked the issue as insufficient quality report
0xRobocop marked the issue as primary issue
Invalid, because of current_share_balance == share_amount
, the user can withdraw all shares.
OpenCoreCH marked the issue as unsatisfactory: Invalid
Lines of code
https://github.com/code-423n4/2024-02-hydradx/blob/main/HydraDX-node/pallets/stableswap/src/lib.rs#L570
Vulnerability details
Impact
In the
stableswap
pallet there are 2 functions that allow LP to withdraw the liquidity:remove_liquidity_one_asset()
andwithdraw_asset_amount()
. Both functions burn user's shares in the end. However, in the first function there are 2 checks on whether the amount of burnt shares are bigger than minimal pool liquidity. This can lead to a situation where LP can't remove all of his liquidity even if the pool total shares are bigger than minimal pool liqudiity.Proof of Concept
Let's consider the pool consisted of 2 assets - USDC, USDT and the amounts provided by LPs are [100, 150].
current_share_balance
will fall below minimal pool liquidity:https://github.com/code-423n4/2024-02-hydradx/blob/main/HydraDX-node/pallets/stableswap/src/lib.rs#L568-571
But the problem is that the pool has minimal liquidity that's enough for it to continue functioning. There is another check that makes sure that the total issuance of shares is bigger than minimal pool liquidity. This should be used as the pointer of whether the user can withdraw his liquidity or can't:
https://github.com/code-423n4/2024-02-hydradx/blob/main/HydraDX-node/pallets/stableswap/src/lib.rs#L581-587
Tools Used
Manual review.
Recommended Mitigation Steps
Remove the check that makes sure that the current share balance of the user is bigger than minimal pool liquidity.
Assessed type
Other