Part 2
Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Wrong Transfer On Initiate Withdrawal

ChainDefenders

Summary

VaultRouterBranch::initiateWithdrawal expects provided shares to be in 18 decimals but doesn't calculate value in the decimals of indexToken when transferring vault.indexToken. In the case in which the index token is not 18 decimals the value transferred will not be what the user expected.

Vulnerability Details

VaultRouterBranch::initiateWithdrawal expects provided shares to be in 18 decimals but doesn't calculate value in the decimals of indexToken when transferring vault.indexToken. In the case in which the index token is not 18 decimals the value transferred will not be what the user expected.

function initiateWithdrawal(uint128 vaultId, uint128 shares) external {
if (shares == 0) {
revert Errors.ZeroInput("sharesAmount");
}
​
// fetch storage slot for vault by id, vault must exist with valid collateral
Vault.Data storage vault = Vault.loadLive(vaultId);
if (!vault.collateral.isEnabled) revert Errors.VaultDoesNotExist(vaultId);
​
// increment vault/user withdrawal request counter and set withdrawal request id
uint128 withdrawalRequestId = ++vault.withdrawalRequestIdCounter[msg.sender];
​
// load storage slot for withdrawal request
WithdrawalRequest.Data storage withdrawalRequest =
WithdrawalRequest.load(vaultId, msg.sender, withdrawalRequestId);
​
// update withdrawal request create time
withdrawalRequest.timestamp = block.timestamp.toUint128();
​
// update withdrawal request shares
withdrawalRequest.shares = shares;
​
// transfer shares to the contract to be later redeemed
IERC20(vault.indexToken).safeTransferFrom(msg.sender, address(this), shares);
​
// emit an event
emit LogInitiateWithdrawal(vaultId, msg.sender, shares);
}

Let's have the following scenario:

  1. indexToken is a token with 12 decimals.

  2. User A makes a call to initiateWithdrawal with shares equal to 1e18, expecting 1 token to be transferred.

  3. A transfer of 1e6 tokens is actually made (1e18 / 1e12).

Impact

Loss for user and unclear transfer logic when initiating withdrawal.

Tools Used

Manual Review

Recommendations

Calculate shares amount in the decimals of the indexToken before making a transfer from msg.sender to the contract.

Updates

Lead Judging Commences

inallhonesty Lead Judge
7 months ago
inallhonesty Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.