As the 'amount' value is not validated against a minimum amount, a potential attacker can make a large number of micro withdrawal requests such a 1e1 for a token with 1e18 decimals. As such they can prevent other users from withdrawing their assets. A resolution to this is implementing a minimum withdrawal amount, although this will need setter limits of it's own to prevent it from being changed to a number so high, no one can withdraw.
Attack Scenario
1) Bob want's to withdraw his tokens
2) Alice dos's the withdrawal mechanism with back to back 1e1 amount withdrawals
3) Each of these will need to be processed first before Bob can withdraw
4) Bob can't withdraw unless he is willing to pay an unbounded amount of Gas to have his withdrawal processed first
179: function _withdraw(address from, address to, uint amount) internal {
180: amount = _burn(from, amount);
181:
182: token().safeTransfer(to, amount);
183:
184: emit Withdrawal(from, to, amount);
185: }
Revised Code File (Optional)
This is a heavily simplified fix, the setting of minimumWithdraw should be bounded within reasonable limits to ensure it cannot be set to extream high or low values.
Instance 0
function withdraw(uint amount) external {
++ require(amount >= minimumWithdraw, "amount too low");
_withdraw(_msgSender(), _msgSender(), amount);
}
Instance 1
function withdrawTo(address to, uint amount) external {
++ require(amount >= minimumWithdraw, "amount too low");
_withdraw(_msgSender(), to, amount);
}
Github username: -- Twitter username: -- Submission hash (on-chain): 0x3f4cafcadc21db7b63735832cdb260e99fd7b78ae7f6e2abbdf4e786e7f1126e Severity: medium
Description: Description
As the 'amount' value is not validated against a minimum amount, a potential attacker can make a large number of micro withdrawal requests such a 1e1 for a token with 1e18 decimals. As such they can prevent other users from withdrawing their assets. A resolution to this is implementing a minimum withdrawal amount, although this will need setter limits of it's own to prevent it from being changed to a number so high, no one can withdraw.
Attack Scenario
1) Bob want's to withdraw his tokens 2) Alice dos's the withdrawal mechanism with back to back 1e1 amount withdrawals 3) Each of these will need to be processed first before Bob can withdraw 4) Bob can't withdraw unless he is willing to pay an unbounded amount of Gas to have his withdrawal processed first
Attachments
['140']
['144']
['179']
This is a heavily simplified fix, the setting of minimumWithdraw should be bounded within reasonable limits to ensure it cannot be set to extream high or low values.
Instance 0
Instance 1
Global Changes