In emergencyWithdraw, if a small amount of tokens are specified, shareAmt is burned but no token is sent.
Summary
The emergencyWithdraw is intended for emergency withdrawals and is different from normal withdrawals. shareAmt should be specified and tokens for that should be withdrawn, but under some conditions tokens may not be withdrawn even if share is burned.
Vulnerability Details
In emergencyWithdraw, uint256 _shareRatio = shareAmt * SAFE_MULTIPLIER / IERC20(address(self.vault)).totalSupply(); to calculate _shareRatio. This ratio is used to calculate the amount of tokens to be sent.
However, even considering SAFE_MULTIPLIER, if the number of digits in shareAmt is less than or equal to the portion of totalSupply that exceeds 1e18, _shareRatio will be zero and the process will proceed as is.
In other words, share will be BURNED, but no token will be received.
Impact
Share is BURNED but does not receive tokens
Tools Used
Manual
Recommendations
Revert when _withdrawAmtTokenA and _withdrawAmtTokenB are zero.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.