Part 2
Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Medium Severity - Underflow in Refund Due to Insufficient USD Amount at `StabilityBranch`

0xsnoweth

Summary

Users can initiate swaps with USD amounts smaller than the base fee, causing refund attempts to revert and permanently locking funds.

Vulnerability Details

The StabilityBranch::initiateSwap function lacks validation that amountsIn[i] >= baseFeeUsd. When combined with refundSwap's unsafe subtraction:

// StabilityBranch.sol (refundSwap)
uint256 refundAmountUsd = depositedUsdToken - baseFeeUsd;

This creates an underflow risk if baseFeeUsd > depositedUsdToken, making refunds impossible and trapping funds indefinitely.

Proof of Concept:

  1. Base fee configured to 10 USD

  2. User initiates swap with 5 USD (amountIn = 5)

  3. Request expires normally

  4. refundSwap attempts 5 - 10 = underflow revert

  5. 5 USD permanently stuck in contract

Impact

Permanent loss of user funds

Requires admin intervention to recover

Violates core protocol safety guarantees

Tools Used

Manual Review

Foundry

Recommendations

Add validation in StabilityBranch::initiateSwap:

require(amountsIn[i] >= tokenSwapData.baseFeeUsd, "Insufficient fee coverage");
Updates

Lead Judging Commences

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.