the-first-elder - Maintainer can Cause a denial of service when calling UpdateXYZ function

[sherlock-admin4]

the-first-elder

medium

Maintainer can Cause a denial of service when calling UpdateXYZ function

Summary

According to the protocol, encountering accidental parameters that lead to adverse states in a contract or transaction is considered a valid issue. The function UpdateXYZ is responsible for adjusting the validity status and supply limits of a specified token.

Vulnerability Detail

Within the function, parameters maxLimit and minLimit are utilized to denote the maximum supply and minimum limit of a token through internal accounting. If a token (tokenA) undergoes an update with a maxLimit value less than its total supply, any attempt to initiate a swap against it in swapAndSend or convertToEXYZ will consistently result in reversion, as evidenced by line and this

Poc

describe("swapping", () => {
            beforeEach("setup", async () => {
                await stablecoinHandler.grantRole(SWAPPER_ROLE, deployer);
                await stablecoinHandler.UpdateXYZ(eUSD, true, 1000000000, 0);
                await stablecoinHandler.UpdateXYZ(eMXN, true, 1000000000, 0);

                await eUSD.grantRole(MINTER_ROLE, deployer);
                await eMXN.grantRole(MINTER_ROLE, deployer);
                await eUSD.grantRole(BLACKLISTER_ROLE, deployer);
                await eMXN.grantRole(BLACKLISTER_ROLE, deployer);

                const Token_Factory = await ethers.getContractFactory(
                    "TestToken",
                    deployer
                );
                USDC = await Token_Factory.deploy(
                    "US Dollar Coin",
                    "USDC",
                    6,
                    holder.address,
                    10
                );
            });

            it("swapAndSend", async () => {
                await eUSD.mintTo(holder, 10);
                await eMXN.mintTo(holder, 1000000000000);
                // totalsupply here is greater than maxlimit above
                const inputs = {
                    destination: holder,
                    origin: eUSD,
                    oAmount: 10,
                    target: eMXN,
                    tAmount: 100,
                };

                await eUSD.connect(holder).approve(stablecoinHandler, 10);

                await expect(stablecoinHandler.swapAndSend(holder, inputs)).to.be
                    .reverted;

            });

            it("convertToEXYZ", async () => {
                await eUSD.mintTo(holder, 10);
                console.log(await eUSD.balanceOf(deployer));
                await eMXN.mintTo(holder, 1000000000000);
                const inputs = {
                    destination: holder,
                    origin: USDC,
                    oAmount: 10,
                    target: eMXN,
                    tAmount: 100,
                };

                await USDC.connect(holder).approve(stablecoinHandler, 10);
                await expect(stablecoinHandler.convertToEXYZ(holder, deployer, inputs))
                    .to.be.reverted;

            });
}

Impact

function call swapAndSend and convertToEXYZ against token A would always revert

Code Snippet

https://github.com/sherlock-audit/2024-02-telcoin-platform-audit-update/blob/main/telcoin-contracts/contracts/stablecoin/StablecoinHandler.sol#L243

Tool used

Manual Review

Recommendation

Implement a conditional statement to ensure that maxLimit is always greater than or equal to the total supply.

[sherlock-admin2]

1 comment(s) were left on this issue during the judging contest.

WangAudit commented:

works as intended

[the-first-elder]

Escalate According to Sherlock rules

When external-admin=restricted, issues related to these external admins affecting a protocol (being audited) by updating the external protocol parameters is a valid issue

[sherlock-admin2]

Escalate According to Sherlock rules

When external-admin=restricted, issues related to these external admins affecting a protocol (being audited) by updating the external protocol parameters is a valid issue

The escalation could not be created because you are not exceeding the escalation threshold.

You can view the required number of additional valid issues/judging contest payouts in your Profile page, in the Sherlock webapp.