Summary

addMigratedUnderlying function can process unneccessary 0 value. This in itself is not a big risk but it can be leveraged in
a sequence of function calls to trigger unwanted behaviour.

Vulnerability Details

The missing check lies in the logic of the addMigratedUnderlying function. The function lacks specific handling for a zero amount scenario.

1. function is called with an amount of 0.

2. function attempts to transfer 0 tokens from the sender to the contract using safeTransferFrom. This typically succeeds in most ERC20 implementations.

3. incrementUnderlying function is called with amount as 0.

4. Inside incrementUnderlying, adding 0 to the existing balanceOfUnderlying doesn't modify the balance.

5. Despite no balance change, a ChangeUnderlying event is emitted with int256(amount), which will be 0.

Impact

Although benign in its impact, missing 0 check allow attackers to log transfers onchain, leading to various phishing attack vectors. Where large holders are target with on-chain spam transactions.
Using address that are similiare in prefix-suffix.

Tools Used

Manual Review

Recommendations

Modify the addMigratedUnderlying function to check for amount equal to 0