search

sherlock-audit / 2024-11-telcoin-judging

0 stars 0 forks source link

0x73696d616f - `AmirX:_verifyDefiSwap()` does not check if the value of the `safe` is `address(0)` in spit of the readme #156

Open sherlock-admin3 opened 2 weeks ago

sherlock-admin3 commented 2 weeks ago

0x73696d616f

Medium

AmirX:_verifyDefiSwap() does not check if the value of the safe is address(0) in spit of the readme

Summary

AmirX:_verifyDefiSwap() does not check if defi.safe is address(0), which means that in AmirX:_buyBack() remaining POL/token balances may be sent to address(0), breaking the readme:

However is the value for a safe is not passed in tokens should not be able to be sent into space or the zero address.

Root Cause

In AmirX:264, defi.safe is not check for address(0).

Internal pre-conditions

None.

External pre-conditions

None.

Attack Path

  1. Swapper calls AmirX:swap() with a feeToken other than Telcoin and address(0) and a defi.safe of address(0), sending tokens to address(0).

Impact

The tokens are sent to address(0) instead of the safe contrarily to the readme.

PoC

if (defi.feeToken != TELCOIN && address(defi.feeToken) != address(0)) {
    if (defi.aggregator == address(0) || defi.swapData.length == 0)
        revert ZeroValueInput("BUYBACK");
}

Mitigation

Add defi.safe check:

if (defi.feeToken != TELCOIN && address(defi.feeToken) != address(0)) {
    if (defi.aggregator == address(0) || defi.swapData.length == 0 || defi.safe == address(0))
        revert ZeroValueInput("BUYBACK");
}