Submission Details
Severity:
Underlying token balance is not checked in `StrategyMainnet::claimAndSwap`
Summary
Balance of underying token is not checked in claimAndSwap function of StrategyMainnet contract.
Vulnerability Details
claimAndSwap function of op and arb contract does check for underlying tokens but for mainnet this check is missing.
uint256 underlyingBalance = underlying.balanceOf(address(this));
require(underlyingBalance >= _amount, "not enough underlying balance");
This check is not in mainnet contract so it should be added.
Impact
Underlying balance can be lower than amount which is not checked.
Tools Used
Manual Review
Recommendations
Protocol should check balance of underlying tokens are greater than amount as checked in op and arb contracts.
Prize pool breakdown
Total prize
16,653 OP
nSLOC
25366 OP / LOC
15,800
853
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.