Tadle

Summary

When unwrapping the wrapped native token, if there is a fluctuation in value or an error in the unwrap process, the amount sent to the user might differ from the claimAbleAmount. However, the function does not check if the actual amount unwrapped and transferred matches the intended amount.

Even though when transferring ERC20 tokens, if there is any slippage, the actual amount transferred might be less than the claimAbleAmount. The function does not verify if the correct amount was transferred, leading to a potential discrepancy.

Vulnerability Details

Impact

Without slippage control, the amount of tokens expected to be transferred might differ from the actual amount. This discrepancy can cause users to receive less than they expect, leading to potential financial losses.

Tools Used

Vscode

Recommendations

The TokenManger contract can be updated to include a Withdraw function that allows msg.sender to specify the minimum native token; calling such TokenManger.withdraw function should revert if the corresponding withdraw function's token output is less than the specified minimum token to be withdraw.

Similarly, the TokenManger contract can also include a maxToken function that allows msg.sender to specify the maximum tokens to be withdraw for calling the corresponding withdraw function.