ElasticSwap contest - 0x1f8b's results

Handle

0x1f8b

Vulnerability details

Impact

Improve require.

Proof of Concept

Total supply must be more or equal to _liquidityTokenQty in Exchange.removeLiquidity.

Tools Used

Manual review

Recommended Mitigation Steps

Change

require(this.totalSupply() > 0, "Exchange: INSUFFICIENT_LIQUIDITY");

to

require(this.totalSupply() >= _liquidityTokenQty, "Exchange: INSUFFICIENT_LIQUIDITY");

Handle

0x1f8b

Vulnerability details

Impact

The method to detect a token with fee it's wrong implemented.

Proof of Concept

The method to detect a token with fee it's wrong implemented in Exchange.addLiquidity:123. If an attacker send one token to the contract, it will never be empty, so the condition of if (isExchangeEmpty) { will never happend, and the require never will be made.

            if (isExchangeEmpty) {
                require(
                    IERC20(baseToken).balanceOf(address(this)) ==
                        tokenQtys.baseTokenQty,
                    "Exchange: FEE_ON_TRANSFER_NOT_SUPPORTED"
                );
            }

Tools Used

Manual review.

Recommended Mitigation Steps

Use a balance difference between before and after.