sherlock-audit / 2024-03-goat-trading-judging

3 stars 2 forks source link

recursiveEth - Potential Token Lock-Up Due to Insufficient Liquidity Transfer #75

Closed sherlock-admin3 closed 8 months ago

sherlock-admin3 commented 8 months ago

recursiveEth

high

Potential Token Lock-Up Due to Insufficient Liquidity Transfer

Summary

function takeOverPool that requires tokens to be transferred to the pool before its execution. If the function fails to execute due to insufficient liquidity or other reasons, the tokens sent to the contract prior to calling this function may get stuck temporarily.

Vulnerability Detail

The vulnerability arises from the requirement that tokens must be transferred to the pool before calling the takeOverPool function. If the function fails due to reasons such as insufficient liquidity or incorrect parameters, the tokens sent to the contract may remain locked up until the issue is resolved.

Impact

This vulnerability could lead to a temporary lock-up of tokens sent to the contract, affecting the liquidity providers' ability to withdraw their funds promptly. It may also result in inconvenience and frustration for users, potentially impacting the protocol's reputation and usability.

Code Snippet

https://github.com/sherlock-audit/2024-03-goat-trading/blob/main/goat-trading/contracts/exchange/GoatV1Pair.sol#L452

Tool used

Manual Review

Recommendation

It is recommended to handle the transfer of tokens within the takeOverPool function itself to ensure atomicity and avoid potential lock-ups of tokens