Sturdy contest - AuditsAreUS's results

Lines of code

https://github.com/code-423n4/2022-05-sturdy/blob/main/smart-contracts/GeneralVault.sol#L75 https://github.com/code-423n4/2022-05-sturdy/blob/78f51a7a74ebe8adfd055bdbaedfddc05632566f/smart-contracts/ConvexCurveLPVault.sol#L131-L149

Vulnerability details

Impact

The function depositCollateral() in GeneralVault.sol is payable. This needs to be payable for the case in LidoVault where _depositToYeild() expects ETH to be transferred.

However for the ConvexCurveLPVault.sol and the case when LidoVault is not using Eth as an asset it is still possible for msg.value to be greater than 0. If this is the case any ETH value attached to the transaction will be stuck in the contract.

Proof of Concept

The function depositCollateral() is payable

  function depositCollateral(address _asset, uint256 _amount) external payable virtual {
    // Deposit asset to vault and receive stAsset
    // Ex: if user deposit 100ETH, this will deposit 100ETH to Lido and receive 100stETH TODO No Lido
    (address _stAsset, uint256 _stAssetAmount) = _depositToYieldPool(_asset, _amount);

Recommended Mitigation Steps

Consider adding checks to _depositToYieldPool() in ConvexCurveLPVault.sol to require msg.value == 0.

Also add checks to _depositToYieldPool() in LidoVault.sol for the case when asset != address(0) to require msg.value == 0.