search

hats-finance / Tapioca--Lending-Engine--0x5bee198f5b060eecd86b299fdbea6b0c07c728dd

Other
0 stars 0 forks source link

`Usdo.send` will run out of gas #22

Open hats-bug-reporter[bot] opened 1 month ago

hats-bug-reporter[bot] commented 1 month ago

Github username: -- Twitter username: -- Submission hash (on-chain): 0x207e30afed3ddf67046e6d01240e28122b7b3dbc796c13a9b795c73c8092aaf9 Severity: high

Description: Description\ In function Usdo.send, it looks that the function keeps calling itself and until runs out of gas, which isn't supposed to be right

Attack Scenario\ [Usdo.send](https://github.com/hats-finance/Tapioca--Lending-Engine--0x5bee198f5b060eecd86b299fdbea6b0c07c728dd/blob/8920782db6044643fd0c682f58ef37f7e59f99b1/contracts/usdo/Accordin to Usdo.sol#L199-L207)'s defination, it keeps calling itself.

198     /// @dev override default `send` behavior to add `whenNotPaused` modifier
199     function send(SendParam calldata _sendParam, MessagingFee calldata _fee, address _refundAddress)
200         external
201         payable
202         override
203         whenNotPaused
204         returns (MessagingReceipt memory msgReceipt, OFTReceipt memory oftReceipt)
205     {
206         (msgReceipt, oftReceipt) = this.send(_sendParam, _fee, _refundAddress);
207     }

Attachments

  1. Proof of Concept (PoC) File

  2. Revised Code File (Optional)

cryptotechmaker commented 1 month ago

Indeed there's an issue here. However, this is not used as we have the sendPacket method. Also it does not add a risk to the protocol by making user or the protocol lose any money. I'll mark it as a Low

maarcweiss commented 4 weeks ago

Hi! We said we were not going to reward lows, but we are going to reward you with 150 USDC as a token of appreciation