The Standard

Summary

Insufficient check can lead to removal of undercollateralised assets by vault owner.

Vulnerability Details

In SmartVaultV3 contract inside removeAsset() function check for canRemoveCollateral() is only performed if (token.addr == _tokenAddr).

if (token.addr == _tokenAddr) require(canRemoveCollateral(token, _amount), UNDER_COLL);

As implementation of getTokenManager().getTokenIfExists() not available but suppose there are 2 types of tokens in assets tokenA, tokenB.

• First removeAsset is called by owner with _tokenaddressB.

• If on next line getTokenManager().getTokenIfExists(_tokenAddressB) gives tokenA.

• on next line (tokenA.addr != _tokenAddressB) but tokenB exist.

as if(false) so inside if statement not check for canRemoveCollateral() and next line send token B

IERC20(_tokenAddr).safeTransfer(_to, _amount);

Impact

Undercollaterised assets can be removed

Tools Used

Manual

Recommendations

apply check
require(token.addr == _tokenAddr,"Address not Same");
require(canRemoveCollateral(token, _amount), UNDER_COLL);