Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

tillIn function in TokenManager does not refund the excess amount causing stuck funds

c0pp3rscr3w3r

Summary

The tillIn function in TokenManager gets amount from from msg.value if the wrappedNative Token is used, however it does not refund the excess amount if the user sends more assuming it'll be refunded or used only as required.

Vulnerability Details

The tillin Function in token manager has a block of code to process wrappedNativeToken, however unlike the code block next to it which transfers only as per required from the allowance of the token. The function has no mechanism to deposit the excess value back to the msg.sender.

This becomes more of an issue when the user does not want to deal his own calculation for added fees.

if (_tokenAddress == wrappedNativeToken) {
/**
* @dev token is native token
* @notice check msg value
* @dev if msg value is less than _amount, revert
* @dev wrap native token and transfer to capital pool
*/
if (msg.value < _amount) { //@audit deposit the excess back
revert Errors.NotEnoughMsgValue(msg.value, _amount);
}
@> IWrappedNativeToken(wrappedNativeToken).deposit{value: _amount}();
_safe_transfer(wrappedNativeToken, capitalPoolAddr, _amount);
}

Impact

The excess funds of the user are permanently lost

Tools Used

Manual analysis

Recommendations

refund the excess msg.value back

Updates

Lead Judging Commences

0xnevi Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

[invalid] finding-TokenManager-tillin-excess

Invalid, these are by default, invalid based on codehawks [general guidelines](https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity#findings-that-may-be-invalid). The check implemented is simply a sufficiency check, it is users responsibility to only send an appropriate amount of native tokens where amount == msg.value when native token is intended to be used as collateral (which will subsequently be deposited as wrapped token). All excess ETH can be rescued using the `Rescuable.sol` contract. > Users sending ETH/native tokens > If contracts allow users to send tokens acc111identally.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.