The elements (address) on the tokens[ ] array are the list of which tokens can hold by the pool, and it could contain two elements (2 address) to eight elements (8 address).
this is one of the biggest pools on Balancer with three tokens USDC, DAI and USDT https://app.balancer.fi/#/ethereum/pool/0x79c58f70905f734641735bc61e45c19dd9ad60bc0000000000000000000004e7
But the maxAmountsIn [ ] can only take the two first indexes (token balance) from tokens[ ].
The main goal here is to read the balance of param.borrowToken in this SPELL.
in case tokens[ ].length == 3 and the param.borrowToken address is in the least index on (e.g.tokens[3] == param.borrowToken)
so the current strategy param.strategyId will never work
Impact
The AuraSpell.sol can't handle some Balancer pools correctly
The user will lose some fees if he invokes increasePosition() first, then he will fail to invoke openPositionFarm()
Ch_301
high
Aura SPELL is not compatible with Balancer pools
Summary
The AuraSpell.sol defines how Blueberry Protocol interacts with Aura pools.
Vulnerability Detail
On the openPositionFarm at the third step
The elements (address) on the
tokens[ ]
array are the list of which tokens can hold by the pool, and it could contain two elements (2 address) to eight elements (8 address).this is one of the biggest pools on Balancer with three tokens USDC, DAI and USDT https://app.balancer.fi/#/ethereum/pool/0x79c58f70905f734641735bc61e45c19dd9ad60bc0000000000000000000004e7 But the
maxAmountsIn [ ]
can only take the two first indexes (token balance) fromtokens[ ]
. The main goal here is to read the balance ofparam.borrowToken
in this SPELL. in casetokens[ ].length == 3
and theparam.borrowToken
address is in the least index on (e.g.tokens[3] == param.borrowToken) so the current strategyparam.strategyId
will never workImpact
increasePosition()
first, then he will fail to invokeopenPositionFarm()
Code Snippet
https://github.com/sherlock-audit/2023-04-blueberry/blob/main/blueberry-core/contracts/spell/AuraSpell.sol#L63-L95
Tool used
Manual Review
Recommendation
Check the
tokens[ ].length
Duplicate of #127