Submission Details
Severity:
Donate tokens
Summary
Attacker donate tokens to inflate the value of poolToken in the pool, liquidity provider must provide more tokens to get the same LP.
Vulnerability Details
The function that calculate required amount of tokens to deposit does not account for donations, this cause the protocol to ask users to send more tokens to get the same LP tokens amount.
function getPoolTokensToDepositBasedOnWeth(
uint256 wethToDeposit
) public view returns (uint256) {
uint256 poolTokenReserves = i_poolToken.balanceOf(address(this));
uint256 wethReserves = i_wethToken.balanceOf(address(this));
return (wethToDeposit * poolTokenReserves) / wethReserves;
}
Impact
Extra cost for liquidity providers
Tools Used
Unit test
Recommendations
Cache the poolTokens reserve in the contract and update it after deposit.
Updates
Rewards breakdown
nSLOC
276This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.