Submission Details
Severity:
Excess ether used for swap is not returned causing user to lose funds
Summary
Users can swap ether collateral by calling the SmartVaultV3::swap() which in turns calls SmartVaultV3::executeNativeSwapAndFee. Assuming that the swap performs correctly without any sandwich attacks, with SmartVaultV3::calculateMinimumAmountOut, the excess ether sent to UniswapV3 is not sent back to vault causing the user to lose ether.
Vulnerability Details
//SmartVaultV3.sol
function executeNativeSwapAndFee(ISwapRouter.ExactInputSingleParams memory _params, uint256 _swapFee) private {
(bool sent,) = payable(ISmartVaultManagerV3(manager).protocol()).call{value: _swapFee}("");
require(sent, "err-swap-fee-native");
ISwapRouter(ISmartVaultManagerV3(manager).swapRouter2()).exactInputSingle{value: _params.amountIn}(_params);
//@audit-issue did not refund excess ether sent
}
...
function swap(bytes32 _inToken, bytes32 _outToken, uint256 _amount) external onlyOwner {
uint256 swapFee = _amount * ISmartVaultManagerV3(manager).swapFeeRate() / ISmartVaultManagerV3(manager).HUNDRED_PC();
address inToken = getSwapAddressFor(_inToken);
uint256 minimumAmountOut = calculateMinimumAmountOut(_inToken, _outToken, _amount); // @audit used wrapped ether as price feeds?
ISwapRouter.ExactInputSingleParams memory params = ISwapRouter.ExactInputSingleParams({
tokenIn: inToken,
tokenOut: getSwapAddressFor(_outToken),
fee: 3000,
recipient: address(this),
deadline: block.timestamp,
amountIn: _amount - swapFee,
amountOutMinimum: minimumAmountOut,
sqrtPriceLimitX96: 0
});
inToken == ISmartVaultManagerV3(manager).weth() ?
executeNativeSwapAndFee(params, swapFee) : //@uadit calls the function to swap ether to other tokens
executeERC20SwapAndFee(params, swapFee);
}
Impact
User will lose the excess ether swapped and not be refunded.
Tools Used
Manual Review
Recommendations
Allow users to specify the minimum amount of tokens and refund the excess ether by using this function Uniswap Refund Function
Updates
Lead Judging Commences
hrishibhat over 1 year ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
Slippage-issue
informational/invalid
thedoctor
over 1 year ago
thedoctor
over 1 year ago
hrishibhat
over 1 year ago
hrishibhat over 1 year ago
Submission Judgement Published Reason: Known issue
Assigned finding tags:
Slippage-issue
informational/invalid
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
60933 USDC / LOC
17,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.