Open sherlock-admin opened 1 year ago
Escalate for 10 USDC
The same reason as #116 but in a different implementation and it needs another solution
Escalate for 10 USDC
The same reason as #116 but in a different implementation and it needs another solution
You've created a valid escalation for 10 USDC!
To remove the escalation from consideration: Delete your comment.
You may delete or edit your escalation comment anytime before the 48-hour escalation window closes. After that, the escalation becomes final.
Escalation accepted
Valid medium This is a valid issue
Escalation accepted
Valid medium This is a valid issue
This issue's escalations have been accepted!
Contestants' payouts and scores will be updated according to the changes made on this issue.
Fix looks good. Contract now correctly burns vault rather than vault.uToken
Ch_301
medium
M-03 wrong token address on
ShortLongSpell.sol
Summary
Vulnerability Detail
ShortLongSpell.openPosition() send
uToken
to SoftVault then deposit it into the Compound protocol to earn a passive yield. In return, SPELL receives share tokes of SoftVaultaddress(strategy.vault)
WERC20.sol
should receiveaddress(strategy.vault)
token, but the logic ofShortLongSpell.sol
subcall (WERC20.sol)wrapper.burn()
and pass theuToken
address (please check the Code Snippet part) instead ofstrategy.vault
addressImpact
Short/Long Spell will never work
Code Snippet
1- https://github.com/sherlock-audit/2023-04-blueberry/blob/main/blueberry-core/contracts/spell/ShortLongSpell.sol#L128-L141
2- https://github.com/sherlock-audit/2023-04-blueberry/blob/main/blueberry-core/contracts/spell/ShortLongSpell.sol#L229-L234
Tool used
Manual Review
Recommendation
1-
2-