Submission Details
Severity:
claimAndSwap() in StrategyOp.sol has no checks whitelisted pairs.
Summary
I mentioned the vulnerability details in previous submit, so I only recommend the mitigation method.
Recommendations
There are two methods to protect this vulnerability.
First
+ uint256 public swapRate = 10000;
+ function setSwapRate(uint256 _rate) onlyManagement{
+ swapRate = _rate;
+}
function _swapUnderlyingToAsset(uint256 _amount, uint256 minOut, IVeloRouter.route[] calldata _path) internal {
// TODO : we swap WETH to ALETH -> need to check that price is better than 1:1
// uint256 oraclePrice = 1e18 * 101 / 100;
- require(minOut > _amount, "minOut too low");
+ require(minOut > _amount * swapRate / 10000, "minOut too low");
uint256 underlyingBalance = underlying.balanceOf(address(this));
require(underlyingBalance >= _amount, "not enough underlying balance");
IVeloRouter(router).swapExactTokensForTokens(_amount, minOut, _path, address(this), block.timestamp);
}
Second;
+ mapping(address => bool) public whitelistedPairs;
+ function addWhitelistedPair(address _pair)onlyManagement {
+ whitelistedPairs[_pair] = true;
+ }
+ function removeWhitelistedPair(address _pair)onlyManagement {
+ whitelistedPairs[_pair] = false;
+ }
function _swapUnderlyingToAsset(uint256 _amount, uint256 minOut, IVeloRouter.route[] calldata _path) internal {
// TODO : we swap WETH to ALETH -> need to check that price is better than 1:1
// uint256 oraclePrice = 1e18 * 101 / 100;
+ require(_path[0].from == underlying);
+ require(_path[_path.length - 1].to == asset);
+ for(uint i, i<_path.length; i++){
+ address _temp = IVeloRouter(router).poolFor(routes[i].from, routes[i].to, routes[i].stable, routes[i].factory);
+ require(whitelistedPairs[_temp] == true);
+ }
require(minOut > _amount, "minOut too low");
uint256 underlyingBalance = underlying.balanceOf(address(this));
require(underlyingBalance >= _amount, "not enough underlying balance");
IVeloRouter(router).swapExactTokensForTokens(_amount, minOut, _path, address(this), block.timestamp);
}
Prize pool breakdown
Total prize
16,653 OP
nSLOC
25366 OP / LOC
15,800
853
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.