hats-finance / Tapioca-0xe0b920d38a0900af3bab7ff0ca0af554129f54ad

4 stars 4 forks source link

Dos in `collectPaymentTokens`if token Revert on Zero Value #34

Open hats-bug-reporter[bot] opened 6 months ago

hats-bug-reporter[bot] commented 6 months ago

Github username: @mgf15 Twitter username: -- Submission hash (on-chain): 0xea0554a86b421deb3891f5368d576522745b01acf5dfdaf6b6c240dd57a8ad1c Severity: medium

Description: Description\ Some tokens (e.g. LEND) revert when transferring a zero value amount. Attack Scenario\ there no check if the paymentToken.balanceOf(address(this)) is zero , if the IERC20 paymentToken = IERC20(_paymentTokens[i]); is token Revert on Zero Value the and paymentToken.balanceOf(address(this)) is zero collectPaymentTokens will be DOSed . Attachments

  1. Proof of Concept (PoC) File

    function collectPaymentTokens(address[] calldata _paymentTokens) external onlyOwner nonReentrant {
        address _paymentTokenBeneficiary = paymentTokenBeneficiary;
        if (_paymentTokenBeneficiary == address(0)) {
            revert PaymentTokenNotSupported();
        }
        uint256 len = _paymentTokens.length;
    
        unchecked {
            for (uint256 i; i < len; ++i) {
                //@audit will Dos if token Revert on Zero Value
                IERC20 paymentToken = IERC20(_paymentTokens[i]);
                paymentToken.safeTransfer(_paymentTokenBeneficiary, paymentToken.balanceOf(address(this)));
            }
        }
    }
  2. Revised Code File (Optional)
0xRektora commented 5 months ago

The revert is a feature, not a bug. I see nothing wrong with reverting on balance 0 of a token. Protocol just has to not put it in the array param.