Submission Details
Severity:
Lack of path validation
Summary
Lack of path validation
Vulnerability Details
The swap functions swapExactTokensForTokens of _swapUnderlyingToAsset accepts routes parameter with arbitrary consequences of routes, consisting of (tokenIn, tokenOut, stable, factory) parameters. Neither Adapter or Router performs a check that the tokenOut parameter of the previous route matches the tokenIn parameter of the successive route.
function _swapUnderlyingToAsset(uint256 _amount, uint256 minOut, IVeloRouter.route[] calldata _path) internal {
// TODO : we swap WETH to ALETH -> need to check that price is better than 1:1
// uint256 oraclePrice = 1e18 * 101 / 100;
require(minOut > _amount, "minOut too low");
uint256 underlyingBalance = underlying.balanceOf(address(this));
require(underlyingBalance >= _amount, "not enough underlying balance");
IVeloRouter(router).swapExactTokensForTokens(_amount, minOut, _path, address(this), block.timestamp);
}
Impact
This may cause unexpected bahaviour
Tools Used
Manual Review
Recommendations
recommend improving the validation of the routes parameter
Prize pool breakdown
Total prize
16,653 OP
nSLOC
25366
OP / LOC
15,800
853
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.