c4-bot-1 commented 8 months ago

Lines of code

https://github.com/code-423n4/2024-02-hydradx/blob/603187123a20e0cb8a7ea85c6a6d718429caad8d/HydraDX-node/pallets/omnipool/src/lib.rs#L471-L474 https://github.com/code-423n4/2024-02-hydradx/blob/603187123a20e0cb8a7ea85c6a6d718429caad8d/HydraDX-node/pallets/omnipool/src/lib.rs#L580-L583

Vulnerability details

Impact

The MinimumPoolLiquidity check is used to ensure there is a minimum amount of liquidity for each token in the omnipool. The issue is that this same limit is used for all tokens, regardless of their token decimals. Thus if the MinimumPoolLiquidity is set to 1e6, while that is an acceptable amount for tokens with 12 decimals, that is a very large number of tokens for a token with only 2 decimals.

This can prevent liquidity providers from providing small amounts of liquidity with low decimal tokens.

Proof of Concept

In the code, the MinimumPoolLiquidity is checked against the amount of tokens. Meanwhile in the stableswap contracts, this same value is checked against the amount of minted shares, which can be expected to be of standard decimals, since it is controlled by the protocol itself.

Tools Used

Manual Review

Recommended Mitigation Steps

Scale up MinimumPoolLiquidity according to the token of the decimals, or put the check on the amount of shares minted instead of the assets put in like done in stableswap.