Juicebox Buyback Delegate - 0xnacho's results

Lines of code

https://github.com/jbx-protocol/juice-contracts-v3/blob/main/contracts/abstract/JBPayoutRedemptionPaymentTerminal3_1.sol#L1500-L1501

Vulnerability details

Impact

If the amount of token returned by swapping is greater than by minting and the _minReturnedTokens value is greater than 0, then the jbEthPaymentTerminal.pay call always fails.

Proof of Concept

This behaviour can be observed by adding the following test to the existing suite:

function test_swapIfQuoteBetterMinReturnedTokens(uint256 _weight) public {
    // Reconfigure with a weight smaller than the quote, slippage included
    _weight = bound(_weight, 0, amountOutForOneEth - (amountOutForOneEth * 500 / 10000) - 1);
    _reconfigure(1, address(delegate), _weight, 5000);

    // Build the metadata using the quote at that block
    bytes memory _metadata = abi.encode(
      bytes32(0),
      bytes32(0),
      amountOutForOneEth, //quote
      500 //slippage 500/10000 = 5%
    );
    
    vm.expectRevert();
    // Pay the project
    jbEthPaymentTerminal.pay{value: 1 ether}(
      1,
      1 ether,
      address(0),
      address(123),
      /* _minReturnedTokens */
      // ---> any value greater than 0
      1,
      /* _preferClaimedTokens */
      true,
      /* _memo */
      'Take my money!',
      /* _delegateMetadata */
      _metadata
    );
  }

Tools Used

• Foundry

Recommended Mitigation Steps

Assessed type

Error