Swivel v3 contest - Franfran's results

Lines of code

https://github.com/code-423n4/2022-07-swivel/blob/main/Swivel/Swivel.sol#L742

Vulnerability details

Impact

Swivel contract uses the redeemUnderlying() function from the Compound CERC20 tokens. This function takes as an input the amount of underlying tokens to be redeemed, which is inconsistent compared to other functions. This issue will lead to user fund losses, everytime any user will want to withdraw from the Compound protocol CERC20 token.

Proof of Concept

Image ipfs://bafkreidpiet5fhn5hzxniyakqsxexbvr3pft4ypelfvgqlbj2ly7byjvui

As you can see, the amount of compounding tokens is taken as an input from the withdraw() function and calls redeemUnderlying(), which should be called with the amount of underlying tokens to get (not the compounding tokens).

Tools Used

Pycharm

Recommended Mitigation Steps

Instead of calling redeemUnderlying(), redeem() should be called, which takes the amount of compounding tokens as an input.