Closed c4-bot-2 closed 5 months ago
This submission is invalid, as it failed to understand code base and see that there is another function for that
forwardETH()
this functions ensure ETH does not get stuck, and also that it does not need to be transferred every time immediately, instead it can be accumulated and sent on DEMAND.
Dismissed.
GalloDaSballo marked the issue as insufficient quality report
trust1995 marked the issue as unsatisfactory: Invalid
@vm06007 What about the first instance? https://github.com/code-423n4/2024-02-wise-lending/blob/main/contracts/PowerFarms/PendlePowerFarm/PendlePowerManager.sol#L21-L29
trust1995 marked the issue as satisfactory
trust1995 marked the issue as primary issue
trust1995 marked issue #199 as primary and marked this issue as a duplicate of 199
trust1995 marked the issue as partial-50
trust1995 marked the issue as satisfactory
Hey @trust1995 , I believe this is an invalid report for this reason:
@vm06007 What about the first instance? https://github.com/code-423n4/2024-02-wise-lending/blob/main/contracts/PowerFarms/PendlePowerFarm/PendlePowerManager.sol#L21-L29
receive()
is declared on the PowerFarms to receive ETH when a position is been closed and pendle returns stETH (mainnet), the closingPositionLogic swaps the received stETH for ETH using Curves, thus, the receive()
on the PendlePowerManager contract is not forwarding to the master. function _swapStETHintoETH(
uint256 _swapAmount,
uint256 _minOutAmount
)
internal
returns (uint256)
{
//@audit => The PowerFarm needs to receive the native tokens that Curves will send to it
return CURVE.exchange(
{
fromIndex: 1,
toIndex: 0,
exactAmountFrom: _swapAmount,
minReceiveAmount: _minOutAmount
}
);
}
Looks like the reporter did not understand what is the real purpose of the receive()
on the PendlePowerManager.
- erFarms to receive ETH when a position is been closed and pendle returns stETH (mainnet), the closingPositionLogic swaps the received stETH for ETH using Curves, thus, the
receive()
on the Pendle
How will the tokens received through _swapStETHintoETH()
leave the contract at a future point in time?
- erFarms to receive ETH when a position is been closed and pendle returns stETH (mainnet), the closingPositionLogic swaps the received stETH for ETH using Curves, thus, the
receive()
on the PendleHow will the tokens received through
_swapStETHintoETH()
leave the contract at a future point in time?
In the same tx, as part of the closingPosition logic, after swapping stETH for ETH, the execution will either call _closingRouteETH()
or _closingRouteToken()
, in any of those functions, after repaying the floashloan, the leftover eth is either send to the caller (_closingRouteETH()
), or the leftover eth is wrapped and the weth is sent to the caller (_closingRouteToken()
).
The swapped native is not left in the power farm, all the swapped eth is used within the same tx.
trust1995 marked the issue as unsatisfactory: Invalid
Lines of code
https://github.com/code-423n4/2024-02-wise-lending/blob/main/contracts/PowerFarms/PendlePowerFarm/PendlePowerManager.sol#L21-L29 https://github.com/code-423n4/2024-02-wise-lending/blob/main/contracts/PowerFarms/PendlePowerFarmController/PendlePowerFarmControllerBase.sol#L125-L133
Vulnerability details
The receive functions in PendlePowerManager:#21 and PendlePowerFarmControllerBase:#125 are not forwarding the received funds to the master address, simply emitting an ETHReceived event. The transfer to master address is implemented in other contracts (e.g WiseLending:#49).
Impact
It locks ETH inside the affected contracts instead of sending to master address.
Proof of Concept
Tools Used
Manual review
Recommended Mitigation Steps
Implement the transfer so ETH funds don't get locked inside the contracts. Proposed fix: