search

code-423n4 / 2024-05-bakerfi-findings

4 stars 4 forks source link

StrategyAAVEv3WSTETH._convertToWETH won't work and user will not be able to withdraw #25

Closed c4-bot-2 closed 5 months ago

c4-bot-2 commented 5 months ago

Lines of code

https://github.com/code-423n4/2024-05-bakerfi/blob/main/contracts/core/strategies/StrategyAAVEv3WSTETH.sol#L56

Vulnerability details

Proof of Concept

StrategyAAVEv3WSTETH._convertToWETH function is responsible to swap wstEth to weth using uniswap. It does it with _swap function.

But the problem is that uniRouterA() is granted with approve by stETH() instead of wstEth. As result swap will always revert.

This is a big problem, because _convertToWETH is called, when users want to withdraw. Withdraw calls will always revert, because of that.

Impact

No ability to withdraw.

Tools Used

VsCode

Recommended Mitigation Steps

You need to provide approve to wstEth tokens.

Assessed type

Error

c4-bot-8 commented 5 months ago

Withdrawn by rvierdiiev