sujithsomraaj / lifi-swap-facet-v3-audit

1 Day Review - 5/28
0 stars 0 forks source link

Ignore `receivingAssetId` in`swapTokensSingleV3ERC20ToNative` function events #3

Open sujithsomraaj opened 6 months ago

sujithsomraaj commented 6 months ago

Context: GenericSwapFacetV3.sol#L117

Description: The function swapTokensSingleV3ERC20ToNative is used to swap ERC20 tokens to the network's native tokens.

However, this function accepts a parameter receivingAssetId in the function params and uses it in the event logs, leading to discrepancies between the final asset received by the user and the logs emitted and could affect external integrators.

FYI, this behavior is handled correctly in a similar swapTokensMultipleV3ERC20ToNative function.

Recommendation: Emit receivingAssetId as address(0) as done in the multiple swap token function.

emit LibSwap.AssetSwapped(
_transactionId,
_swapData.callTo,
sendingAssetId,
- receivingAssetId,
+ address(0),
fromAmount,
amountReceived,
block.timestamp
);

LI.FI:

Researcher:

sujithsomraaj commented 6 months ago
    function test_CanSwapSingleERC20ToNative_V2() public {
        // get swapData USDC > ETH (native)
        (
            LibSwap.SwapData[] memory swapData,
            uint256 minAmountOut
        ) = _produceSwapDataERC20ToNative(address(genericSwapFacet));

        swapData[0].receivingAssetId = address(420);

        // pre-register max approval between diamond and dex to get realistic gas usage
        vm.startPrank(address(genericSwapFacet));
        usdc.approve(swapData[0].approveTo, type(uint256).max);
        vm.stopPrank();

        vm.startPrank(USDC_HOLDER);

        uint256 gasLeftBef = gasleft();

        vm.expectEmit(true, true, true, true, address(diamond));
        emit LiFiGenericSwapCompleted(
            0x0000000000000000000000000000000000000000000000000000000000000000, // transactionId,
            "integrator", // integrator,
            "referrer", // referrer,
            SOME_WALLET, // receiver,
            USDC_ADDRESS, // fromAssetId,
            address(0), // toAssetId,
            swapData[0].fromAmount, // fromAmount,
            minAmountOut // toAmount (with liquidity in that selected block)
        );

        genericSwapFacetV3.swapTokensSingleV3ERC20ToNative(
            "",
            "integrator",
            "referrer",
            payable(SOME_WALLET), // receiver
            minAmountOut,
            swapData[0]
        );

        uint256 gasUsed = gasLeftBef - gasleft();
        console.log("gas used V2: ", gasUsed);

        vm.stopPrank();
    }

PoC, if required

0xDEnYO commented 6 months ago

Like the suggestion and added it. Thank you