Submission Details
Severity:
The `swap()` function inside `SmartValut.sol` does not check same token swap, which leads user to pay unintended fee for swap.
Summary
The protocol provide swap feature which will allow smart vault to swap tokens inside protocol, however the function does not check if inToken and outToken are same.
Vulnerability Details
Code
function swap(bytes32 _inToken, bytes32 _outToken, uint256 _amount) external onlyOwner {
// @audit : no check for same token swap , unswap will revert its better to check it here.
uint256 swapFee = _amount * ISmartVaultManagerV3(manager).swapFeeRate() / ISmartVaultManagerV3(manager).HUNDRED_PC();
address inToken = getSwapAddressFor(_inToken);
uint256 minimumAmountOut = calculateMinimumAmountOut(_inToken, _outToken, _amount);
ISwapRouter.ExactInputSingleParams memory params = ISwapRouter.ExactInputSingleParams({
@> tokenIn: inToken,
@> tokenOut: getSwapAddressFor(_outToken),
fee: 3000, // @audit : it is not recommended to put hardcode value here
recipient: address(this),
deadline: block.timestamp,
amountIn: _amount - swapFee,
amountOutMinimum: minimumAmountOut,
sqrtPriceLimitX96: 0
});
inToken == ISmartVaultManagerV3(manager).weth() ?
executeNativeSwapAndFee(params, swapFee) :
executeERC20SwapAndFee(params, swapFee);
Impact
If User unintentionally or mistakenly provide same inToken and outToken he will going to pay swapFee and uniswap fee with out in benefit.
Tools Used
Manual review
Recommendations
It is Recommended to check if inToken and outToken are same then revert.
@@ -212,13 +214,16 @@ contract SmartVaultV3 is ISmartVault {
}
function swap(bytes32 _inToken, bytes32 _outToken, uint256 _amount) external onlyOwner {
+ // @audit : no check for same token swap,
uint256 swapFee = _amount * ISmartVaultManagerV3(manager).swapFeeRate() / ISmartVaultManagerV3(manager).HUNDRED_PC();
address inToken = getSwapAddressFor(_inToken);
+ address outToken = getSwapAddressFor(_outToken);
+ require(inToken != outToken , "can-not swap same token");
uint256 minimumAmountOut = calculateMinimumAmountOut(_inToken, _outToken, _amount);
ISwapRouter.ExactInputSingleParams memory params = ISwapRouter.ExactInputSingleParams({
tokenIn: inToken,
- tokenOut: getSwapAddressFor(_outToken),
- fee: 3000,
+ tokenOut: outToken,
+ fee: 3000,
recipient: address(this),
deadline: block.timestamp,
amountIn: _amount - swapFee,
Updates
Lead Judging Commences
hrishibhat over 1 year ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
informational/invalid
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
60933 USDC / LOC
17,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.