First Flight #18: T-Swap
First Flight #18
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Possible reentrancy attack for some tokens

jennifersun

Summary

Some tokens have transfer callback, eg, ERC777 tokens. Hackers can make use of this characteristic to earn profit.

Vulnerability Details

T-Swap protocol can support any ERC20 tokens. It means some tokens with transfer callback are expected to be supported, for example, some ERC777 tokens. And the whole protocol does not avoid the possible reentrancy issues. Hackers may make use of this to make profits.

When users want to add some liquidity in pools, assume i_poolToken is one ERC777 token, poolToken's safeTransferFrom() is one reentrancy risk. Now Lp shares have already minted, and related weth tokens have transferred to the contract, but we have not tranferred poolToken until now. This will lead that current LP share's price is low than expected. We can mint LP share with lower price. And current pool token's price is larger than expected. Hackers can earn profit via this vulnerability.

function _addLiquidityMintAndTransfer(
uint256 wethToDeposit,
uint256 poolTokensToDeposit,
uint256 liquidityTokensToMint
) private {
_mint(msg.sender, liquidityTokensToMint);
emit LiquidityAdded(msg.sender, poolTokensToDeposit, wethToDeposit);
​
// Interactions
// @audit[Done] fee on transfer Token
i_wethToken.safeTransferFrom(msg.sender, address(this), wethToDeposit);
@==>i_poolToken.safeTransferFrom(
msg.sender,
address(this),
poolTokensToDeposit
);
}
function transfer(address recipient, uint256 amount) public virtual override returns (bool) {
require(recipient != address(0), "ERC777: transfer to the zero address");
​
address from = _msgSender();
​
_callTokensToSend(from, from, recipient, amount, "", "");
​
_move(from, from, recipient, amount, "", "");
​
_callTokensReceived(from, from, recipient, amount, "", "", false);
​
return true;
}
​

Impact

Hackers can earn profit via this reentrancy issue.

Tools Used

Manual

Recommendations

Add reentrancy protection.

Updates

Appeal created

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Too generic
Assigned finding tags:

ERC777

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.