Description:
An attacker can grief the pool contracts by front-running the first deposit and passing zero for maximumPoolTokensToDeposit
. This will render the pool useless because no one else can use the deposit
function to fill the needed poolTokens
. Since in getPoolTokensToDepositBasedOnWeth
, the poolTokenReserves
would always be zero unless the initial depositor transfers the poolTokens directly to the contract. But this itself gives an incentive to the griefer because he can withdraw and get compensation after the direct transfer was done.
Impact:
The impact of this vulnerability is significant as it allows an attacker to prevent legitimate users from participating in the pool by front-running the initial deposit. By doing so, the attacker can ensure that the pool remains underutilized or completely unusable for others who wish to deposit into it. This attack not only disrupts the intended functionality of the pool but also undermines trust in the platform, potentially leading to financial losses for those who attempt to interact with the compromised pool. Additionally, the attacker can exploit this situation to extract value from the system at the expense of legitimate participants, thereby gaining an unfair advantage.
Proof of Concept:
Add the following test to the existing test suite. Exploit steps:
The attacker waits for a createPool
transaction in the mempool.
After finding one, they front-run or simply deposit some ETH and zero poolTokens before the actual pool creator intends to deposit.
LP can't deposit poolTokens via deposit function; LP has to transfer funds directly to run the pool.
Attacker withdraws getting more than his initial balance in PoolToken and losing no WETH.
Recommended Mitigation:
Set a minimum deposit for pool token and check for it in the initial deposit. This way, even if the attacker front-runs the initial deposit, they won't gain anything from it. Note that this is just a simple example, and the real implementation should probably get the minimum initial pool token amount in the constructor.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.