Steadefi

Summary

Function only checks sending msg.value when receiving native coins as deposits for tokenA or Token B.

Vulnerability Details

When depositing into the vault, the dp.executionFee is only checked against the msg.value when the user is depositing a native coin, at other times, it checks that the user supplied dp.executionfee is less than the minExecution fee but does not check that the msg.value actually contains the expected value, this can lead to users using funds sent in the vault by unsuspecting users as execution fee for deposits.

Impact

User does not pay for execution with own funds.

Tools Used

manual.

Recommendations

Check that msg.value contains execution fee even if not expecting native coins.