PoolTogether V5: Part Deux - MatricksDeCoder's results

Lines of code

https://github.com/GenerationSoftware/pt-v5-cgda-liquidator/blob/7f95bcacd4a566c2becb98d55c1886cadbaa8897/src/LiquidationRouter.sol#L69 https://github.com/GenerationSoftware/pt-v5-vault-boost/blob/9d640051ab61a0fdbcc9500814b7f8242db9aec2/src/VaultBooster.sol#L173 https://github.com/GenerationSoftware/pt-v5-vault-boost/blob/9d640051ab61a0fdbcc9500814b7f8242db9aec2/src/VaultBooster.sol#L193

Vulnerability details

Impact

There are various tokens and token standards that can result in transfers being stopped, blocked, blacklisted, paused or disallowed. This entails protocols may function well with these tokens up until a time when any of above measures activated leading to inability to perform transfers into and out of the protocol

Proof of Concept

Tokens such as ERC20Pausable, Pausable Tokens like WBTC, ERC1400, Polymath like tokens; it implies the all instances mentioned in the links provided will not function for transfers. Whats worse is tokens with blacklisting capabilities may block contract addresses of protocol which renders them incapable to send and receive these tokens to function fully.

e.g in instances below IERC20(collateralAsset).safeTransfer(ROEROUTER.treasury(), feeAmount); // if collateralAsset is asset that can be paused for transfers then cant send fees to treasury

IERC20(_liquidationPair.tokenIn()).safeTransferFrom(... // LiquidationPair.sol cant transfer in tokenIn from user

_token.safeTransferFrom(msg.sender, address(this), _amount); // users cant deposit token into VaultBooster.sol contract that is used to liquidate arbitrary tokens for a vaul

_token.transfer(msg.sender, _amount); // users cant withdraw the token from VaultBooster.sol

...function liquidate(...) { ....IERC20(_tokenOut).safeTransfer(_account, _amountOut); } // users cant liquidate tokens

etc

Tools Used

Manual Analysis

Recommended Mitigation Steps

It is recommended such tokens be disallowed from being used with the protocol Consider a whitelist of allowed tokens

Assessed type

Token-Transfer