Closed howlbot-integration[bot] closed 3 months ago
koolexcrypto changed the severity to QA (Quality Assurance)
This is technically possible, but very unlikely. If users decide to set recipient to address(0), their tokens can be lost (need a PoC). We are changing the recipient validation
koolexcrypto marked the issue as grade-c
Lines of code
https://github.com/code-423n4/2024-05-loop/blob/0dc8467ccff27230e7c0530b619524cc8401e22a/src/PrelaunchPoints.sol#L258-L265 https://github.com/code-423n4/2024-05-loop/blob/0dc8467ccff27230e7c0530b619524cc8401e22a/src/PrelaunchPoints.sol#L439-L441
Vulnerability details
Bug Description
When calling
claim()
orclaimAndStake()
to convert their deposited LRT tokens to ETH and then to lpETH, users can choose between two exchanges for the swap-UniswapV3
andTransformERC20
, and two recipients-the PrelaunchPoints contract or themselves (msg.sender).Once LRTs are swapped to ETH, they are supposed to be deposited into lpETH to credit the
_receiver
(user) with the lpETH tokens owed.However, when choosing to use
claim()
orclaimAndStake()
withUniswapV3
as the exchange parameter andaddress(0)
(msg.sender) as the recipient, this line will return0
and won't account for the effective claimed amount:claimedAmount = address(this).balance;
Consequently, it will not reflect the actual amount claimed, and no tokens will be deposited into lpETH to be credited to the user.Furthermore, the
Claimed
event will erroneously emitclaimedAmount == 0
, which can disrupt off-chain accounting performed by the LoopFi backend.Recommendation
To accurately track the claimed amount, use the return value
uint256 buyAmount
fromUniswapV3Feature.sellTokenForEthToUniswapV3()
instead of relying onclaimedAmount = address(this).balance;
.Assessed type
Other