Revert Lend - 0xGreyWolf's results

Lines of code

https://github.com/code-423n4/2024-03-revert-lend/blob/435b054f9ad2404173f36f0f74a5096c894b12b7/src/V3Vault.sol#L360-L393

Vulnerability details

Impact

The functions deposit(), mint(), deposit() with permit2, mint() with permit2, withdraw(), redeem() invokes _convertToAssets() or _convertToShares which relies heavily on an exchange rate / exchangeRateX96 that can change often.

It is reasonable that as the lender deposits (sends input tokens) to the vault, he/she should receive the rightful amount of shares on that moment. Also, when the lender redeems his/her collateral he/she should receive the rightful amount of assets on that moment.

If the token amount to be received (whether that be assets or shares) is less than what he/she expects, the transaction should revert. Hence the purpose of slippage protection.

Proof of Concept

Tools Used

Manual Review

Recommended Mitigation Steps

Here's an example of redeem implementation with slippage protection.

    function redeem(uint256 shares, address receiver, address owner) external override returns (uint256) { 
        (uint256 assets,) = _withdraw(receiver, owner, shares, true);
        return assets;
    }

++  function redeem(uint256 shares, address receiver, address owner, uint256 minAssets) external override returns (uint256) { 
++      (uint256 assets,) = _withdraw(receiver, owner, shares, true);    
++      if (assets < minAssets) revert TooMuchSlippageNotAllowed();
    
++      return assets;
++  }

Implement this pattern to the rest of the functions: deposit(), mint(), deposit() with permit2, mint() with permit2, withdraw().

Assessed type

Other