First Flight #18: T-Swap
First Flight #18
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Should mint a few shares to 0 address in the first mint

jennifersun

Summary

In the first deposit operation, contract should mint a few shares to 0 address to protect the protocol.

Vulnerability Details

When the pool is empty, and first depositor wants to mint some LP shares, the contract will mint the related share amount to the depositor directly. The hacker may make use of this to control this pool.
Possible attack vector is like as below:

  1. Hacker find one empty pool.

  2. Make use of the deposit()/withdraw() operation to make only 1 wei LP share in the pool.

  3. Donation weth & pool tokens to increase LP share's price rapidly.

  4. Most common investors don't have enough funds to mint 1 wei share.
    This will block other investors' participation for this pool.

function deposit(
uint256 wethToDeposit,
uint256 minimumLiquidityTokensToMint,
uint256 maximumPoolTokensToDeposit,
// @audit [Done], deadline does not work
uint64 deadline
)
external
revertIfZero(wethToDeposit)
returns (uint256 liquidityTokensToMint)
{
if (wethToDeposit < MINIMUM_WETH_LIQUIDITY) {
revert TSwapPool__WethDepositAmountTooLow(
MINIMUM_WETH_LIQUIDITY,
wethToDeposit
);
}
if (totalLiquidityTokenSupply() > 0) {
......
} else {
// This will be the "initial" funding of the protocol. We are starting from blank here!
// We just have them send the tokens in, and we mint liquidity tokens based on the weth
// @audit first mint attack
_addLiquidityMintAndTransfer(
wethToDeposit,
maximumPoolTokensToDeposit,
wethToDeposit
);
liquidityTokensToMint = wethToDeposit;
}
}

Impact

Common investors cannot become the LP holders.

Tools Used

Manual

Recommendations

Mint a few LP shares to address(0) in the first mint.

Updates

Appeal created

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

Frontrun first deposit to steal all WETH

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.