stake.link

Summary

The WrappedTokenBridge.sol::recoverTokens function does not properly handle the refund of user token causing loss of token

Vulnerability Details

If we have a scenario where user A mistakenly send some amount of a token to the WrappedTokenBridge.sol contract and user B also mistakenly send some amount of the same token and then another user C also mistakenly send some amount of the same token to the contract, at that point any user that comes first to the protocol team to retrieve there token would get all of the tokens in the WrappedTokenBridge.sol making it so the other two users lost their token as whenever they come to claim their token there would be no balance in the WrappedTokenBridge.sol

Impact

Below is a step by step guide to test and confirm the vulnerability
Open the wrapped-token-bridge.test.ts file and paste the below code in the beforeEach block of the test code

Then paste the below test inside of the describe block of the test code

Then run the below code in your terminal

On running the code above you should get the below output that shows that indeed the vulnerability was exploited

Tools Used

Hardhat Test suite

Recommendations

I know well enough it can really be some extra works to always check how much is mistakenly sent by any user who mistakenly send this contract some token but if the protocol would prefer to keep this functionality then they would really need to have some eventListener that would always listen to an event that is emitted whenever the WrappedTokenBridge.sol receive token and the event details can be used to map the sent amount to each user that mistakenly send the token and then whenever a user wants to retrieve their token this mapping can be use to get the amount sent by them and send them back just that amount instead of all the balance of the contract on the mistakenly sent token.