search

code-423n4 / 2024-02-thruster-findings

2 stars 1 forks source link

ThrusterPoolDeployer will not be able to claim gas fees #4

Closed c4-bot-5 closed 8 months ago

c4-bot-5 commented 8 months ago

Lines of code

https://github.com/code-423n4/2024-02-thruster/blob/main/thruster-protocol/thruster-clmm/contracts/ThrusterPoolDeployer.sol#L46

Vulnerability details

Proof of Concept

ThrusterPoolDeployer contract is used to deploy new pools. It is configured to claim used gas.

But it will not claim anything, as it uses address(0) as contract to claim gas for instead of address(this).

Impact

Lost of gas fees for protocol.

Tools Used

VsCode

Recommended Mitigation Steps

Claim gas for address(this) address.

Assessed type

Error

c4-judge commented 8 months ago

0xleastwood marked the issue as satisfactory

jooleseth commented 8 months ago

This is a duplicate of #13, as mentioned we believe it should be marked as Medium not High

flowercrimson commented 8 months ago

I think this should be duplicate of #24, #14.

4,#24,#14 all deal with gas yield DOS resulted from address(0). The same lines of code.

c4-sponsor commented 8 months ago

jooleseth marked the issue as disagree with severity

c4-sponsor commented 8 months ago

jooleseth (sponsor) acknowledged

c4-judge commented 8 months ago

0xleastwood removed the grade

c4-judge commented 8 months ago

0xleastwood marked the issue as duplicate of #24

c4-judge commented 8 months ago

0xleastwood changed the severity to 2 (Med Risk)

0xleastwood commented 8 months ago

Agree with medium severity, user's funds are not at risk here.

c4-judge commented 8 months ago

0xleastwood marked the issue as satisfactory