Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Unsafe transfer #285

Closed
code423n4 opened this issue Sep 19, 2022 · 1 comment
Closed

Unsafe transfer #285

code423n4 opened this issue Sep 19, 2022 · 1 comment
Labels
3 (High Risk) Assets can be stolen/lost/compromised directly bug Something isn't working disagree with severity Sponsor confirms validity, but disagrees with warden’s risk assessment (sponsor explain in comments) duplicate This issue or pull request already exists invalid This doesn't seem right old-submission-method unsatisfactory does not satisfy C4 submission criteria; not eligible for awards

Comments

@code423n4
Copy link
Contributor

Lines of code

https://github.com/code-423n4/2022-09-y2k-finance/blob/main/src/Vault.sol#L167
https://github.com/code-423n4/2022-09-y2k-finance/blob/main/src/Vault.sol#L228
https://github.com/code-423n4/2022-09-y2k-finance/blob/main/src/Vault.sol#L231

Vulnerability details

Impact

Unsafe transfer

Proof of Concept

https://github.com/code-423n4/2022-09-y2k-finance/blob/main/src/Vault.sol#L167

https://github.com/code-423n4/2022-09-y2k-finance/blob/main/src/Vault.sol#L228

https://github.com/code-423n4/2022-09-y2k-finance/blob/main/src/Vault.sol#L231

Some tokens don't revert on transfer failure but they return a boolean value instead.
This value is not checked. Thus, the attacker can trick the protocol into that the transfer was successful and then withdraw his shares and steal tokens in results

Tools Used

Manual review

Recommended Mitigation Steps

Use safeTransfer library or manually check the return value
@code423n4 code423n4 added 3 (High Risk) Assets can be stolen/lost/compromised directly bug Something isn't working old-submission-method labels Sep 19, 2022
code423n4 added a commit that referenced this issue Sep 19, 2022
@code423n4
PwnPatrol issue #285
6a3dbff
@3xHarry
Copy link
Collaborator

3xHarry commented Sep 22, 2022

dup #499, The protocol only uses WETH as underlying asset, meaning transfers would revert if not successful

@3xHarry 3xHarry added duplicate This issue or pull request already exists disagree with severity Sponsor confirms validity, but disagrees with warden’s risk assessment (sponsor explain in comments) labels Sep 22, 2022
@HickupHH3 HickupHH3 added the unsatisfactory does not satisfy C4 submission criteria; not eligible for awards label Oct 18, 2022
@JeeberC4 JeeberC4 added the invalid This doesn't seem right label Nov 9, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
3 (High Risk) Assets can be stolen/lost/compromised directly bug Something isn't working disagree with severity Sponsor confirms validity, but disagrees with warden’s risk assessment (sponsor explain in comments) duplicate This issue or pull request already exists invalid This doesn't seem right old-submission-method unsatisfactory does not satisfy C4 submission criteria; not eligible for awards
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
5 participants
@MiguelBits @code423n4 @HickupHH3 @JeeberC4 @3xHarry