Submission Details
Impact:
Likelihood:
Lack of balance check of the token and not updating the value of the token before and after withdrawing the token in the emergency withdraw function
The smart contract has an emergency withdraw function that withdraws tokens from the smart contract without checking if there are any tokens in the smart contract and even if it withdraws the tokens , it does not update the state of the smart contract that is the value that is withdrawn is not deducted from the total number of tokens
The Risk of this vulnerability in the smart contract is that this may lead to the smart contract displaying wrong value of the token that is available and may break the working of the smart contract , and the code that is carrying the vulnerability is below
function emergencyWithdrawERC20(address _tokenAddress, uint256 _amount, address _to) external onlyOwner {
if (
_tokenAddress == address(iWETH) || _tokenAddress == address(iWBTC) || _tokenAddress == address(iWSOL)
|| _tokenAddress == address(iUSDC)
) {
revert("Cannot withdraw core order book tokens via emergency function");
}
if (_to == address(0)) {
revert InvalidAddress();
}
IERC20 token = IERC20(_tokenAddress);
token.safeTransfer(_to, _amount);
emit EmergencyWithdrawal(_tokenAddress, _amount, _to);
}
Likelihood:
The likelihood of this occuring is 100 percent because of the flawed code in the smart contract that when called does not check if there is value in that token that needs to be withdrawn and even after withdrawing the token it does not update the state of the balance of the token
Impact:
This will lead to the smart contract holding the wrong information and incosistency about the value of the tokens that the smart contract is holding
Rewards breakdown
nSLOC
217This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.