Part 2
Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

User's deposited USD token for swap can be stuck

h2134

Summary

User's deposited USD token for swap can be stuck.

Vulnerability Details

When a user initiates multiple (or one) USD token swap requests by calling initiateSwap(), user transfers in some amount of USD tokens.

StabilityBranch::initiateSwap():

// transfer USD: user => address(this) - burned in fulfillSwap
ctx.usdTokenOfEngine = IERC20(configuration.usdTokenOfEngine[currentVault.engine]);
ctx.usdTokenOfEngine.safeTransferFrom(msg.sender, address(this), amountsIn[i]);

If the swap request has not been processed and has expired, user can call refundSwap() to get a refund, the refunded amount is deducted by a base fee which is a fixed amount.

StabilityBranch::refundSwap():

// cache the amount of usd tokens to be refunded
uint256 refundAmountUsd = depositedUsdToken - baseFeeUsd;

However, it's possible that base fee is incresed by owner and becomes larger than the user's deposited amount, as a result, the refund transaction will revert with underflow error, and the funds are stucked.

MarketMakingEngineConfigurationBranch::configureUsdTokenSwapConfig():

function configureUsdTokenSwapConfig(
uint128 baseFeeUsd,
uint128 swapSettlementFeeBps,
uint128 maxExecutionTime
)
external
onlyOwner
{
if (maxExecutionTime == 0) {
revert Errors.ZeroInput("maxExecutionTime");
}
​
// emits event internally
UsdTokenSwapConfig.update(baseFeeUsd, swapSettlementFeeBps, maxExecutionTime);
}

Impact

User's deposited USD token for swap is stuck, the protocol will not receive a fee.

Tools Used

Manual Review

Recommendations

If user's deposited amount is less than the base fee, distribute the deposited funds as a fee without refunding.

Updates

Lead Judging Commences

inallhonesty Lead Judge 4 months ago
Submission Judgement Published
Validated
Assigned finding tags:

initiateSwap can be called with amount < than base fee, making the refund function revert due to underflow - funds stuck

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.