Closed sherlock-admin closed 1 year ago
In the case of the router for Pendle, the swaps will always be directly from underlying to PT, in which case the output will be formatted [input token amount (underlying), output token amount (PT)]. As a result, the [1]
will contain the number of PTs received in the swap.
Jeiwan
high
Wrong return value in the Pendle's
lend
function can cause lose of funds or excessive iPT issuanceSummary
Wrong return value in the Pendle's
lend
function can cause lose of funds or excessive iPT issuanceVulnerability Detail
The
swapExactTokensForTokens
function returns an array of amounts, with the first element being the input amount (IPendle.sol#L12, UniswapV2Router02.sol#L231, UniswapV2Library.sol#L65). Thelend
functions uses the first amount, however it must check the last output amount to ensure the correct number of tokens was swapped (Lender.sol#L546).Impact
Lending using the Pendle's
lend
function will always make users lose funds or mint more iPTs than expected since thereturned
variable will always equal theamount
variable and not the actual number of principal tokens.Code Snippet
Lender.sol#L521;
Tool used
Manual Review
Recommendation
Consider checking the returned value of the
swapExactTokensForTokens
function and ensuring the correct element of the returned array is used.