Caviar Private Pools - Naubit's results

Lines of code

https://github.com/code-423n4/2023-04-caviar/blob/cd8a92667bcb6657f70657183769c244d04c015c/src/PrivatePool.sol#L733

Vulnerability details

Impact

In the change() function at https://github.com/code-423n4/2023-04-caviar/blob/cd8a92667bcb6657f70657183769c244d04c015c/src/PrivatePool.sol#L733, which is used to allow the caller to change a set of NFTs that the caller owns for another set of NFTs in the pool; there is a line where the contract calculates the fee and protocol fee amounts for those NFTs being changed.

This function will fail, causing a revert of the change() function (and then causing a revert of the change() function in theEthRouter file (https://github.com/code-423n4/2023-04-caviar/blob/cd8a92667bcb6657f70657183769c244d04c015c/src/EthRouter.sol#L273) when the baseToken decimals are less than 4, as explained in the "Proof of Concept" section.

Proof of Concept

When calling the function changeFeeQuote to calculate the feeAmount and protocolFeeAmount vars of a change in a private pool, if the base token set in the private pool has 3 decimals or less, the subtraction performed at https://github.com/code-423n4/2023-04-caviar/blob/cd8a92667bcb6657f70657183769c244d04c015c/src/PrivatePool.sol#L733 will fail.

In Solidity 0.8.19 (the version used by the contract) it will revert the operation so we won't be able to calculate those fees, causing that we won't be able to change NFTs in the pool.

Tools Used

VS Code

Recommended Mitigation Steps

Before trying to do the subtraction, it should verify the baseToken has at least 4 decimals. In case it has less, it would need to adjust the subtraction value before calculating it.