Ethena Labs - Avci's results

Lines of code

https://github.com/code-423n4/2023-10-ethena/blob/ee67d9b542642c9757a6b826c82d0cae60256509/contracts/EthenaMinting.sol#L352-L355

Vulnerability details

Impact

in the Ethenaminting.sol Contract and in the VerifyRoute() function in line 353 there is IF that checks if the order type is ordertype.REDEEM but as you saw in the comments of that if it suppose to // routes only used to mint

so that means ordertype. should not be redeem. but it is and it should return false instead of true

Proof of Concept

 function verifyRoute(Route calldata route, OrderType orderType) public view override returns (bool) {
    // routes only used to mint
    if (orderType == OrderType.REDEEM) {
      return true;
    }

Tools Used

vs code / brain

Recommended Mitigation Steps

• consider returning false instead of true

Assessed type

Other