search

code-423n4 / 2024-07-reserve-validation

0 stars 0 forks source link

Function manageTokens can be front-runned, causing user calls to fail #187

Closed c4-bot-6 closed 1 month ago

c4-bot-6 commented 1 month ago

Lines of code

https://github.com/code-423n4/2024-07-reserve/blob/main/contracts/p1/RevenueTrader.sol#L129-L131 https://github.com/code-423n4/2024-07-reserve/blob/main/contracts/p1/RevenueTrader.sol#L157

Vulnerability details

Impact

Function manageTokens can be front-runned, causing user calls to fail.

Details

Function manageTokens is used to trade in exchange for tokenToBuy. However, malicious users can front-run it, causing normal users' calls to fail. Firstly, _distributeTokenToBuy will revert when the reward amount is zero. Secondly, when the trades[erc20] is not zero, it also will revert. So, malicious can expliot it to make legitimate users' transactions fail.

Tools Used

Vscode

Recommended Mitigation Steps

  1. When the reward amount is zero, should do nothing instead of revert.
  2. Prevent small amount trades.

Assessed type

Context