Caviar contest - 0xDave's results

Lines of code

https://github.com/code-423n4/2022-12-caviar/blob/0212f9dc3b6a418803dbfacda0e340e059b8aae2/src/Pair.sol#L147-L176 https://github.com/code-423n4/2022-12-caviar/blob/0212f9dc3b6a418803dbfacda0e340e059b8aae2/src/Pair.sol#L398-L400

Vulnerability details

Impact

Due to the absence of checking the inputAmount value, the pair's funds can be stolen.

Proof of Concept

require(inputAmount <= maxInputAmount, "Slippage: amount in");

There is no guarantee that the inputAmount is greater than zero. In the following situations, a problem occurs when the inputAmount becomes 0.

1. The value of baseTokenReserves() is much smaller than the value of fractionalTokenReserves()
2. If baseToken is not ETH

As many tokens as outputAmount exit the pair, but the token does not enter the pair because inputAmount is 0.

Recommended Mitigation Steps

In the buyQuote function, it is recommended to add code that guarantees that the inputAmount is greater than zero.

    function buyQuote(uint256 outputAmount) public view returns (uint256 inputAmount) {
        uint256 inputAmount = (outputAmount * 1000 * baseTokenReserves()) / ((fractionalTokenReserves() - outputAmount) * 997);
      	require(inputAmount > 0, "InputAmount is zero");
        return inputAmount;
    }