Summary
The function TSwapPool::deposit must have verification if the variable maximumPoolTokensToDeposit is different to zero and equal or greather than minimumLiquidityTokensToMint
Vulnerability Details
When TSwapPool::deposit is called we don't have a verification if the maximumPoolTokensToDeposit variable is zero and equal or greather than minimumLiquidityTokensToMint to have a valid parameter, as we can see below:
function deposit(
uint256 wethToDeposit,
uint256 minimumLiquidityTokensToMint,
uint256 maximumPoolTokensToDeposit,
uint64 deadline
)
external
revertIfZero(wethToDeposit)
returns (uint256 liquidityTokensToMint)
{
...
Impact
If the maximumPoolTokensToDeposit is zero or less than the minimumLiquidityTokensToMint the deposit will be invalid.
Tools Used
Solidity and Foundry
Proof of Concept
Add the following PoC to test/unit/TSwapPool.t.sol:
function testIfMaximumPoolTokensToDepositIsZeroOrLessThanMinimumLiquidityTokensToMint() public {
vm.startPrank(liquidityProvider);
uint256 wethToDeposit = 200e18;
uint256 minimumLiquidityTokensToMint = 1;
uint256 maximumPoolTokensToDeposit = 0;
uint64 deadline = uint64(block.timestamp);
weth.approve(address(pool), wethToDeposit);
poolToken.approve(address(pool), wethToDeposit);
vm.expectRevert(TSwapPool.TSwapPool__MustBeMoreThanZero.selector);
pool.deposit(
wethToDeposit, minimumLiquidityTokensToMint, maximumPoolTokensToDeposit, deadline
);
minimumLiquidityTokensToMint = 10;
maximumPoolTokensToDeposit = 9;
vm.expectRevert(TSwapPool.TSwapPool__MaximumPoolTokensToDepositMustBeEqualOrMoreThanMinimumLiquidityTokensToMint.selector);
pool.deposit(
wethToDeposit, minimumLiquidityTokensToMint, maximumPoolTokensToDeposit, deadline
);
vm.stopPrank();
}
Recommendations
You need to add the custom error in the src/TSwapPool.sol:
error TSwapPool__MustBeMoreThanZero();
+ error TSwapPool__MaximumPoolTokensToDepositMustBeEqualOrMoreThanMinimumLiquidityTokensToMint();
And add the verification on TSwapPool::deposit:
function deposit(
uint256 wethToDeposit,
uint256 minimumLiquidityTokensToMint,
uint256 maximumPoolTokensToDeposit,
uint64 deadline
)
external
revertIfZero(wethToDeposit)
+ revertIfZero(maximumPoolTokensToDeposit)
returns (uint256 liquidityTokensToMint)
{
+ if(minimumLiquidityTokensToMint > maximumPoolTokensToDeposit) {
+ revert TSwapPool__MaximumPoolTokensToDepositMustBeEqualOrMoreThanMinimumLiquidityTokensToMint();
+ }
if (wethToDeposit < MINIMUM_WETH_LIQUIDITY) {
revert TSwapPool__WethDepositAmountTooLow(
MINIMUM_WETH_LIQUIDITY,
wethToDeposit
);
}
