Closed sherlock-admin4 closed 2 months ago
1 comment(s) were left on this issue during the judging contest.
WildSniper commented:
not high due to the following quote, "Inflicts serious non-material losses (doesn't include contract simply not working". And a valid medium due to this quote, "Breaks core contract functionality, rendering the contract useless or leading to loss of funds." really nice catch
merlin
medium
A griefer can perform DOS attack on all major functions of the StrategyPassiveManagerVelodrome smart contract
Summary
The
deposit, withdraw, moveTicks, setPositionWidth, and unpause
functions all call the internal_addLiquidity
function, which interacts with themint()
function from theNftPositionManager
smart contract.Vulnerability Detail
Here is the internal
_mintPosition
function fromStrategyPassiveManagerVelodrome
smart contract, which will always fail due to griefers.Let's analyze the
NonfungiblePositionManager.mint
function. If we look at the end of the function, it callsrefundETH
, which sends any remainingETH
back tomsg.sender
:So, a griefer in this situation could simply send 1 wei of
ETH
to theNonfungiblePositionManager
smart contract, and then all major functions ofStrategyPassiveManagerVelodrome
would be blocked.Impact
All major functions of
StrategyPassiveManagerVelodrome
would be blocked.Code Snippet
contracts/strategies/velodrome/StrategyPassiveManagerVelodrome.sol#L321
Tool used
Manual Review
Recommendation
Consider adding a
receive
function to theStrategyPassiveManagerVelodrome
smart contract.Duplicate of #69