Open c4-bot-10 opened 5 months ago
0xEVom marked the issue as duplicate of #188
0xEVom marked the issue as insufficient quality report
Insufficient proof
jhsagd76 changed the severity to QA (Quality Assurance)
jhsagd76 marked the issue as grade-a
Lines of code
https://github.com/code-423n4/2024-03-revert-lend/blob/main/src/utils/Swapper.sol#L172 https://github.com/code-423n4/2024-03-revert-lend/blob/main/src/utils/Swapper.sol#L161 https://github.com/Uniswap/v3-periphery/blob/main/contracts/libraries/PoolAddress.sol#L33
Vulnerability details
Impact
A malicious user can steal tokens from the Swapper by providing data with a fake token
Proof of Concept
Swapper contract accept callbacks from uniswap pools where amount for swap is payed:
It tries to verify that a call was made from the real pool by calling
_getPool
and calculate the real address:The problem is it never verifies that the pool exist, but only tries to get the address:
So a malicious user can calculate and delopy the contract that will match the calculated address with the information about a token he wants to steal and a fake token.
It will require some serious computaions for the hacker to break the right hash and build the valid address, but it is still possible with modern tools.
Tools Used
Manual review
Recommended Mitigation Steps
Verify with the factory that msg.sender is a valid pool
Assessed type
Invalid Validation