Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Excess ether sent to tillIn() will be lost

anonymousjoe

Summary

The excess ether sent to any contract that uses the tillIn() function will be lost. This is significantly impactful since the frequency of excess ether being sent will be high.

Vulnerability Details

Any excess ether (> _amount) sent to the tillIn() function is not refunded to the msg.sender and thus will be lost.

https://github.com/Cyfrin/2024-08-tadle/blob/04fd8634701697184a3f3a5558b41c109866e5f8/src/core/TokenManager.sol#L79-L90

if (_tokenAddress == wrappedNativeToken) {
/**
* @dev token is native token
* @notice check msg value
* @dev if msg value is less than _amount, revert
* @dev wrap native token and transfer to capital pool
*/
if (msg.value < _amount) {
revert Errors.NotEnoughMsgValue(msg.value, _amount);
}
IWrappedNativeToken(wrappedNativeToken).deposit{value: _amount}();
_safe_transfer(wrappedNativeToken, capitalPoolAddr, _amount);

In the tillIn function if the msg.value > amount, the excess ether (msg.value - amount) is ignored and only the amount is being transferred to the capitalPoolAddr.

This is significant because many users WILL be sending excess ether.

For example:
In the PreMarkets.sol, while calling the createTakerfunction, the exact amount that a user has to pay is not exactly clear.
This is because it not only includes the collateral Amount, but also the trade tax, and the platform fees. Each of which is rounded up/ rounded down quite complexly.

This would mean that a user most likely overpay by a little. And this amount will be lost in the tillIn() function.

Impact

The accumulated loss of funds over many iterations would be a significant amount to the user.

Tools Used

Manual Review

Recommendations

Refund the extra amount of ether/token sent to the tillIn() function.

Updates

Lead Judging Commences

0xnevi Lead Judge 11 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

[invalid] finding-TokenManager-tillin-excess

Invalid, these are by default, invalid based on codehawks [general guidelines](https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity#findings-that-may-be-invalid). The check implemented is simply a sufficiency check, it is users responsibility to only send an appropriate amount of native tokens where amount == msg.value when native token is intended to be used as collateral (which will subsequently be deposited as wrapped token). All excess ETH can be rescued using the `Rescuable.sol` contract. > Users sending ETH/native tokens > If contracts allow users to send tokens acc111identally.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.