search

sherlock-audit / 2022-09-notional-judging

4 stars 2 forks source link

ctf_sec - Linear Pool in Balancer does use joinPool() and exitPool() for transactions involving their Balancer Pool Tokens (BPT) #120

Closed sherlock-admin closed 1 year ago

sherlock-admin commented 1 year ago

ctf_sec

high

Linear Pool in Balancer does use joinPool() and exitPool() for transactions involving their Balancer Pool Tokens (BPT)

Summary

Linear Pool in Balancer does use joinPool() and exitPool() for transactions involving their Balancer Pool Tokens (BPT)

Vulnerability Detail

Currently, when joining the pool or exist the pool, the function calls

function _joinPoolExactToken -> Deployments.BALANCER_VAULT.joinPool

function _exitPoolExactBPTIn -> Deployments.BALANCER_VAULT.exitPool

Deployments.BALANCER_VAULT.joinPool

and

Deployments.BALANCER_VAULT.exitPool

However, I want to quote the highlight from the balancer v2 deep dive documentation

https://dev.balancer.fi/deep-dive/guided-tour-of-balancer-vault/episode-2-joins#intro

Not all pools use joinPool() and exitPool() for transactions involving their Balancer Pool Tokens (BPTs). A LinearPool, for example, mints all of its BPT and the time of creation and registers them as a pool token so that users can join/exit the pool only via swap() or batchSwap().

https://dev.balancer.fi/deep-dive/guided-tour-of-balancer-vault/episode-2-joins#intro

Are you trying to calculate amounts for a pool that uses Phantom BPT? *LinearPools and StablePhantomPools do not have join or exit functionality since those are handled as swaps! For example, if you want to figure out how much bb-a-USD you'll get for an amount of DAI, you'll need to use queryBatchSwap on a trade route that swaps DAI for bb-a-DAI and then swaps bb-a-DAI for bb-a-USD.

I believe the linear pool that does not have join or exit funactionality is quite common in balancer

https://dev.balancer.fi/resources/deploy-pools-from-factory/creation/aavelinearpool

there are a whole section talking about how tthe aavelinearpool work.

AaveLinearPools facilitate trades between token/waToken. They can only be deployed for tokens that have Aave aTokens and require you to deploy an Aave aToken Wrapper if one does not already exist. For this page, we will assume we have a new USD stablecoin called USDX that already has an Aave aToken, aUSDX.

Here is the definition of linear pool

https://docs.balancer.fi/products/balancer-pools/boosted-pools#linear-pools

Linear Pools are the base component of Boosted Pools. They use Linear Math to facilitate trades between two tokens at a known exchange rate. They also use a positive/negative fee mechanism to incentivize arbitrageurs to maintain a desired ratio between the two tokens. For example, the Balancer Aave Boosted Pool (DAI) balances DAI with aDAI, facilitating DAI trades while maintaining a large aDAI balance for an extra boost to Liquidity Providers.

Impact

Only using joinPool or exitPool would leave such a big portion of the pool (such as linear pool) unsupported.

Code Snippet

https://github.com/sherlock-audit/2022-09-notional/blob/main/leveraged-vaults/contracts/vaults/balancer/internal/pool/BalancerUtils.sol#L66-L90

https://github.com/sherlock-audit/2022-09-notional/blob/main/leveraged-vaults/contracts/vaults/balancer/internal/pool/BalancerUtils.sol#L93-L123

Tool used

Manual Review

Recommendation

We recommend the project add support for linear pool, instead of hardcoding joinPool and existPool