You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on Apr 28, 2024. It is now read-only.
DuplicateA valid issue that is a duplicate of an issue with `Has Duplicates` labelMediumA valid Medium severity issueRewardA payout will be made for this issue
The borrow() function may end up in scenarios where cache.borrowedAmount is less than cache.holdTokenBalance, The line uint256 borrowingCollateral = cache.borrowedAmount - cache.holdTokenBalance; within the borrow() function is will revert due to underflow, leading to an UniV3 position available for Wagmi protocol which cannot be borrowed.
(saleTokenBalance, cache.holdTokenBalance) =_getPairBalance(
params.saleToken,
params.holdToken
);
// Check if the sale token balance is greater than 0if (saleTokenBalance >0) {
if (params.externalSwap.swapTarget !=address(0)) {
// Call the external swap function and update the hold token balance in the cache
cache.holdTokenBalance +=_patchAmountsAndCallSwap(
params.saleToken,
params.holdToken,
params.externalSwap,
saleTokenBalance,
0
);
} else {
// Call the internal v3SwapExactInput function and update the hold token balance in the cache
cache.holdTokenBalance +=_v3SwapExactInput(
v3SwapExactInputParams({
fee: params.internalSwapPoolfee,
tokenIn: params.saleToken,
tokenOut: params.holdToken,
amountIn: saleTokenBalance,
amountOutMinimum: 0
})
);
}
}
I see 3 scenarios where cache.holdTokenBalance can be > cache.borrowedAmount and lead to a DOS :
If the position has earned fees in saleToken, then those could be swapped for holdToken by either internal or external swaps, thus increasing the cache.holdTokenBalance.
If the price has moved favorably since the position was established, the amount of holdToken needed for the same liquidity could be less than initially calculated.
If there is low liquidity for saleToken, but a high liquidity for holdToken, you may end up with more holdToken after the swap, making cache.holdTokenBalance greater than cache.borrowedAmount.
Impact
Underflow leading to an UniV3 position unable to be borrowed
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Labels
DuplicateA valid issue that is a duplicate of an issue with `Has Duplicates` labelMediumA valid Medium severity issueRewardA payout will be made for this issue
lil.eth
medium
Underflow in borrow() Function
Summary
The borrow() function may end up in scenarios where
cache.borrowedAmount
is less thancache.holdTokenBalance
, The lineuint256 borrowingCollateral = cache.borrowedAmount - cache.holdTokenBalance;
within theborrow()
function is will revert due to underflow, leading to an UniV3 position available for Wagmi protocol which cannot be borrowed.Vulnerability Detail
cache.borrowedAmount
is the result from this function :which basically return number of holdBalance tokens needed to re-gain liquidity amount in a single UniV3 position.
On the other way
cache.holdTokenBalance
is calculated by the number of holdToken extracted at current tick + swapped saleToken collected :I see 3 scenarios where
cache.holdTokenBalance
can be >cache.borrowedAmount
and lead to a DOS :saleToken
, then those could be swapped forholdToken
by either internal or external swaps, thus increasing thecache.holdTokenBalance
.holdToken
needed for the same liquidity could be less than initially calculated.saleToken
, but a high liquidity forholdToken
, you may end up with moreholdToken
after the swap, makingcache.holdTokenBalance
greater thancache.borrowedAmount
.Impact
Underflow leading to an UniV3 position unable to be borrowed
Code Snippet
https://github.com/sherlock-audit/2023-10-real-wagmi/blob/main/wagmi-leverage/contracts/abstract/LiquidityManager.sol#L116C5-L140C6
https://github.com/sherlock-audit/2023-10-real-wagmi/blob/main/wagmi-leverage/contracts/abstract/LiquidityManager.sol#L150
https://github.com/sherlock-audit/2023-10-real-wagmi/blob/main/wagmi-leverage/contracts/LiquidityBorrowingManager.sol#L869
https://github.com/sherlock-audit/2023-10-real-wagmi/blob/main/wagmi-leverage/contracts/LiquidityBorrowingManager.sol#L874
Tool used
Manual Review
Recommendation
Check which of the 2 variables is bigger than the other and adapt the calculation :
Duplicate of #86
The text was updated successfully, but these errors were encountered: