Platform: Code4rena
Start Date: 12/12/2022
Pot Size: $36,500 USDC
Total HM: 8
Participants: 103
Period: 7 days
Judge: berndartmueller
Id: 193
League: ETH
Rank: 69/103
Findings: 1
Award: $40.26
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: Jeiwan
Also found by: 0xxm, 9svR6w, BAHOZ, Bobface, CRYP70, Chom, HE1M, Junnon, RaymondFam, UNCHAIN, __141345__, bytehat, carlitox477, caventa, cccz, chaduke, hansfriese, hihen, koxuan, mauricio1802, minhquanym, minhtrng, nicobevi, obront, shung, unforgiven, wait
40.2564 USDC - $40.26
https://github.com/code-423n4/2022-12-caviar/blob/0212f9dc3b6a418803dbfacda0e340e059b8aae2/src/Pair.sol#L77 https://github.com/code-423n4/2022-12-caviar/blob/0212f9dc3b6a418803dbfacda0e340e059b8aae2/src/Pair.sol#L421-L423
The function addQuote will calculate the number of Lp tokens to mint when user try to add liquidity. The amount of Lp tokens is determined by taking the minimum proportion of base token or fractional token.
However, the excessive tokens (either base token or fractional token) are not returned to user, that is, the user may invest more tokens than expected and obtained the lowest Lp tokens.
Assume user call function add with very large baseTokenAmount and relatively small fractionalTokenAmount, the amount of Lp tokens to mint is calculated based on fractionalTokenAmount. The excessive base token will be lost.
Only transfer the amount of tokens that matches the amount of Lp tokens minted to the user, and return excessive base token back to user when it is ETH.
#0 - c4-judge
2022-12-28T15:00:51Z
berndartmueller marked the issue as duplicate of #376
#1 - c4-judge
2023-01-10T09:02:17Z
berndartmueller marked the issue as satisfactory