Trick or Treat
First Flight #27
Beginner FriendlyFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Repayments mechanism, might generate DOS, Higher costs on `transfers` and user experience degradation.

edmpulasky

Summary

SpookySwap implement repayments at in SpookySwap:trickOrTreat and SpookySwap:resolveTrick, which repays exceeded amounts. Therefore, doing it so to msg.sender contracts and even to those with heavy computations might always revert DOS and may require higher gas computation for just SpookySwap:trickOrTreat.

Vulnerability Details

SpookySwap implement repayments, which repays exceeded amounts. Therefore, doing it so to msg.sender contracts and even to those with heavy computations might always revert DOS and may require higher gas computation for just SpookySwap:trickOrTreat.

function trickOrTreat(string memory _treatName) public payable nonReentrant {
/* impl */
if (msg.value > requiredCost) {
uint256 refund = msg.value - requiredCost;
@> (bool refundSuccess,) = msg.sender.call{ value: refund }("");
require(refundSuccess, "Refund failed");
}
}
​
function resolveTrick(uint256 tokenId) public payable nonReentrant {
/* impl */
if (totalPaid > requiredCost) {
uint256 refund = totalPaid - requiredCost;
@> (bool refundSuccess,) = msg.sender.call{ value: refund }("");
require(refundSuccess, "Refund failed");
}
}

Impact

Although repays are done via msg.call{value} repaying in the same transaction give users the flexibility to run in their fallback any code, that in case of heavy computations it can revert and even generate higher cost per transaction.

Tools Used

  • Manual Review

  • Foundry Testing Tool

​
contract BadBuyer {
uint256 val;
​
receive() external payable {
//100
while (gasleft() > 0) {
val = type(uint256).max;
}
}
}
​
function testInefficientRepayment() public {
protocol.addTreat("candy", 0.1 ether, "uri1");
​
BadBuyer buyer = new BadBuyer();
vm.deal(address(buyer), 1 ether);
vm.prank(address(buyer));
vm.expectRevert();
protocol.trickOrTreat{ value: 0.2 ether }("candy");
}

Recommendations

  • mantain a record of pending-repay

  • consider an implementation for allowing user to withdraw repays.

Updates

Appeal created

bube Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.