Tadle
Tadle
DeFi
30,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Dust token may exist when `tillIn`

vineyard

Summary

Dust native tokens may exist in TokenManager.

Vulnerability Details

When users interact with functions that call tokenManager.tillIn{value: msg.value}(...amount...), any excess ETH sent (when msg.value > _amount) remains in the contract.

if (msg.value < _amount) {
revert Errors.NotEnoughMsgValue(msg.value, _amount); //@audit dust token
}
IWrappedNativeToken(wrappedNativeToken).deposit{value: _amount}();
_safe_transfer(wrappedNativeToken, capitalPoolAddr, _amount);

Take PreMarktes.listOfferas an example, the tillIn function invoked as follows:

if (makerInfo.offerSettleType == OfferSettleType.Protected) {
uint256 transferAmount = OfferLibraries.getDepositAmount(
offerInfo.offerType,
offerInfo.collateralRate,
_amount,
true,
Math.Rounding.Ceil
);
​
ITokenManager tokenManager = tadleFactory.getTokenManager();
tokenManager.tillIn{value: msg.value}(
_msgSender(),
makerInfo.tokenAddress,
transferAmount,
false
);
}

The transferAmount is calculated with getDepositAmount, msg.value may larger than transferAmountsince it depends on input, as a result, dust native tokens left.

Impact

Dust native tokens accumulated in the TokenManager

Tools Used

Manual

Recommendations

Adding refund mechanism or only allows msg.value == _amount
Note: corresponding logic like non-reentrant should be considered while refunding.

Updates

Lead Judging Commences

0xnevi Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Known issue
Assigned finding tags:

[invalid] finding-TokenManager-tillin-excess

Invalid, these are by default, invalid based on codehawks [general guidelines](https://docs.codehawks.com/hawks-auditors/how-to-determine-a-finding-validity#findings-that-may-be-invalid). The check implemented is simply a sufficiency check, it is users responsibility to only send an appropriate amount of native tokens where amount == msg.value when native token is intended to be used as collateral (which will subsequently be deposited as wrapped token). All excess ETH can be rescued using the `Rescuable.sol` contract. > Users sending ETH/native tokens > If contracts allow users to send tokens acc111identally.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.