Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Unhandled Excess ETH in Native Token Deposits

sparrow

Summary

The tillIn function in TokenManager.sol does not properly handle cases where the sent ETH (msg.value) exceeds the specified deposit amount (_amount) for native token transactions. This can lead to unintended locking of user funds in the contract.

Vulnerability Details

In the tillIn function, when dealing with native token (ETH) deposits, the contract only checks if msg.value is less than _amount:

if (_tokenAddress == wrappedNativeToken) {
if (msg.value < _amount) {
revert Errors.NotEnoughMsgValue(msg.value, _amount);
}
IWrappedNativeToken(wrappedNativeToken).deposit{value: _amount}();
_safe_transfer(wrappedNativeToken, capitalPoolAddr, _amount);
}

However, it does not handle cases where msg.value is greater than _amount. The excess ETH sent with the transaction will be trapped in the contract without being accounted for or refunded to the user.

Impact

  • Users may unintentionally lose funds by sending more ETH than intended.

  • The contract's ETH balance may become inconsistent with the recorded user balances.

  • There's no mechanism to recover or refund the excess ETH, leading to permanently locked funds.

Tools Used

Manual code review

Recommendations

  • Implement exact matching of msg.value and _amount for native token transactions:

if (_tokenAddress == wrappedNativeToken) {
if (msg.value != _amount) {
revert Errors.InvalidMsgValue(msg.value, _amount);
}
// ... rest of the code
}

Alternatively, if the contract should accept larger deposits, modify the function to use the full msg.value:

  • Add a mechanism to refund any excess ETH

Updates

Lead Judging Commences

0xnevi Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

[invalid] finding-TokenManager-tillin-excess

Invalid, these are by default, invalid based on codehawks [general guidelines](https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity#findings-that-may-be-invalid). The check implemented is simply a sufficiency check, it is users responsibility to only send an appropriate amount of native tokens where amount == msg.value when native token is intended to be used as collateral (which will subsequently be deposited as wrapped token). All excess ETH can be rescued using the `Rescuable.sol` contract. > Users sending ETH/native tokens > If contracts allow users to send tokens acc111identally.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.