Closed howlbot-integration[bot] closed 4 months ago
This is out of scope, since it is on the frontend. However, still invalid as you should pass includedSources
in the request. The default is 0x, that's why you receive the TRANSFORM_SELECTOR
=> 0x415565b0
koolexcrypto marked the issue as primary issue
koolexcrypto marked the issue as unsatisfactory: Invalid
Lines of code
https://github.com/code-423n4/2024-05-loop/blob/0dc8467ccff27230e7c0530b619524cc8401e22a/src/PrelaunchPoints.sol#L204-L235 https://github.com/code-423n4/2024-05-loop/blob/0dc8467ccff27230e7c0530b619524cc8401e22a/src/PrelaunchPoints.sol#L414
Vulnerability details
Bug Description
Users can call
claim()
to receive their vested lpETH, orclaimAndStake()
to additionally stake them in a Loop vault for extra rewards.PrelaunchPoints.sol#L204-L235
Users can call these functions to convert their deposited LRTs into ETH, which is then deposited into the lpETH contract to receive vested lpETH tokens.
When users choose to convert their deposited LRT tokens to lpETH, they can opt to swap through either
UniswapV3
orTransformERC20
.PrelaunchPoints.sol#L37-L40
However, choosing to swap through
UniswapV3
will always fail because the data obtained from the 0x API always returns theTRANSFORM_SELECTOR = 0x415565b0
, which leads to a revert when this check fails:PrelaunchPoints.sol#L414C17-L414C17
This is the command to make a Swap Quote request to 0x (add your API key):
but the data returned by the 0x API always starts by
0x415565b0
.Recommendation
Remove the
UNI_SELECTOR
check, as the correct checks are already implemented inexchangeProxy
:ZeroEx#L48
PrelaunchPoints.sol#L412-L416
Assessed type
Other