Converter problems

Summary

Converter contract is not polished and may leak value.

Vulnerability Detail

There are several problems with the Converter. When trying to withdraw from Aave, it approves the underlying token, not the principal:

  // Allow the pool to spend the funds
  Safe.approve(IERC20(u), pool, a);
  // withdraw from Aave
  IAaveLendingPool(pool).withdraw(u, a, msg.sender);

Also, if tokens are accidentally sent to this contract or unintentionally stuck (a reference to another issue regarding Compound integration), anyone can redeem them.

Impact

The current version of Converter is not reliable to be used in prod.

Code Snippet

https://github.com/sherlock-audit/2022-10-illuminate/blob/main/src/Converter.sol

Tool used

Manual Review

Recommendation

Consider improving the robustness of the Converter and fixing the aforementioned issues.

sherlock-audit / 2022-10-illuminate-judging

HonorLt - Converter problems #224