Ch_301 - liquidateVaultsForToken() is not transferring the funds for the swap in asyncSwapper

[sherlock-admin2]

Ch_301

medium

liquidateVaultsForToken() is not transferring the funds for the swap in asyncSwapper

Summary

LiquidationRow.liquidateVaultsForToken() is not transferring the funds for the swap.

Vulnerability Detail

LIQUIDATOR invokes LiquidationRow.liquidateVaultsForToken().
one of the things that need to be done here is initiating the swap process via the asyncSwapper. by sub call to LiquidationRow._performLiquidation()

File: LiquidationRow.sol
240:     function _performLiquidation(
...
243:         address asyncSwapper,
244:         IDestinationVault[] memory vaultsToLiquidate,
245:         SwapParams memory params,
...
248:     ) private {
249:         uint256 length = vaultsToLiquidate.length;
250:         // the swapper checks that the amount received is greater or equal than the params.buyAmount
251:         uint256 amountReceived = IAsyncSwapper(asyncSwapper).swap(params);

the asyncSwapper needs to receive the funds from LiquidationRow.sol first, because it need to set the approval for the AGGREGATOR.

File: BaseAsyncSwapper.sol
19:     function swap(SwapParams memory swapParams) public virtual nonReentrant returns (uint256 buyTokenAmountReceived) {
...
24: 
25:         IERC20 sellToken = IERC20(swapParams.sellTokenAddress);
26:         IERC20 buyToken = IERC20(swapParams.buyTokenAddress);
27: 
28:         uint256 sellTokenBalance = sellToken.balanceOf(address(this));
29: 
30:         if (sellTokenBalance < swapParams.sellAmount) {
31:             revert InsufficientBalance(sellTokenBalance, swapParams.sellAmount);
32:         }
33: 
34:         LibAdapter._approve(sellToken, AGGREGATOR, swapParams.sellAmount);
...
41:         (bool success,) = AGGREGATOR.call(swapParams.data);
...

otherways it will revert with InsufficientBalance(...)

Impact

• LIQUIDATOR is not able to call LiquidationRow.liquidateVaultsForToken().
• Rewards are not aggregated
• Rewards will stack forever in e.g:AURA, CONVEX
• LMP Vault will never receive rewards

Code Snippet

https://github.com/sherlock-audit/2023-06-tokemak/blob/main/v2-core-audit-2023-07-14/src/liquidation/BaseAsyncSwapper.sol#L19-L34

Tool used

Manual Review

Recommendation

Transfer the funds (swapParams.sellTokenAddress) to asyncSwapper first.

Duplicate of #205