Open sherlock-admin opened 1 year ago
Fix looks good. If pool is dead then it will remove as all tokens instead of a single token. No slippage protection for withdrawal has been given in this case but this is fine as pool is dead so getting sandwiched is impossible.
Bauer
high
Users can fail to closePositionFarm and lose their funds
Summary
If self.is_killed in the curve pool contract becomes true, user may be unable to call the
CurveSpell.closePositionFarm()
function to repay his debt, resulting in his assets being liquidated.Vulnerability Detail
The
CurveSpell.closePositionFarm()
function is used to unwind a position on a strategy that involves farming CRV rewards through staking LP tokens in a Curve pool. Inside the function, the protocol swaps the harvested CRV tokens to the debt token, and calculates the actual amount of LP tokens to remove from the Curve pool. It then removes the LP tokens using the remove_liquidity_one_coin function of the Curve pool.If self.is_killed in the curve pool contract becomes true, calling such
remove_liquidity_one_coin()
function would always revert. In this case, calling theCurveSpell.closePositionFarm()
function reverts. When user's position is about to be liquidated, if theclosePositionFarm()
function is DOS'ed,user may be unable to repay his debt, resulting in the user losing their fundsImpact
If self.is_killed in the curve pool contract becomes true, user may be unable to repay his debt, resulting in his assets being liquidated.
Code Snippet
https://github.com/sherlock-audit/2023-04-blueberry/blob/main/blueberry-core/contracts/spell/CurveSpell.sol#L197
Tool used
Manual Review
Recommendation