Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

dust ETH should return the user in `TokenManager.tillIn`

zer0

Summary

TokenManager.tillIn keeps dust ETH left in the contract instead of returning to the user

Vulnerability Details

in TokenManager.tillIn, when native token is used in TokenManager.sol#L78-L91, the function checks if msg.value < _amount and then deposit _amount native token for wrapped token.
It's possible that a user transfer more native token than _amount, in such case, the dust token will be left in the contract.

56 function tillIn(
57 address _accountAddress,
58 address _tokenAddress,
59 uint256 _amount,
60 bool _isPointToken
61 )
...
79 if (_tokenAddress == wrappedNativeToken) {
80 /**
81 * @dev token is native token
82 * @notice check msg value
83 * @dev if msg value is less than _amount, revert
84 * @dev wrap native token and transfer to capital pool
85 */
86 if (msg.value < _amount) {
87 revert Errors.NotEnoughMsgValue(msg.value, _amount);
88 }
89 IWrappedNativeToken(wrappedNativeToken).deposit{value: _amount}(); <<< --- here only `_amount` will be deposited, and if `msg.value > _amout`, the rest will be left
90 _safe_transfer(wrappedNativeToken, capitalPoolAddr, _amount);
91 } else {
...
103 }
​

Impact

dust native token will be left in the contract

Tools Used

VS code

Recommendations

diff --git a/src/core/TokenManager.sol b/src/core/TokenManager.sol
index 1d1b2ea..200a997 100644
--- a/src/core/TokenManager.sol
+++ b/src/core/TokenManager.sol
@@ -86,6 +86,7 @@ contract TokenManager is
if (msg.value < _amount) {
revert Errors.NotEnoughMsgValue(msg.value, _amount);
}
+ _amount = msg.value;
IWrappedNativeToken(wrappedNativeToken).deposit{value: _amount}();
_safe_transfer(wrappedNativeToken, capitalPoolAddr, _amount);
} else {
Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

[invalid] finding-TokenManager-tillin-excess

Invalid, these are by default, invalid based on codehawks [general guidelines](https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity#findings-that-may-be-invalid). The check implemented is simply a sufficiency check, it is users responsibility to only send an appropriate amount of native tokens where amount == msg.value when native token is intended to be used as collateral (which will subsequently be deposited as wrapped token). All excess ETH can be rescued using the `Rescuable.sol` contract. > Users sending ETH/native tokens > If contracts allow users to send tokens acc111identally.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.