PoolTogether - Omik's results

Lines of code

https://github.com/code-423n4/2024-03-pooltogether/blob/main/pt-v5-vault/src/PrizeVault.sol#L540

Vulnerability details

Impact

The prize vault allowed its user to deposit using a signature through depositWithPermit(), which allowed the user to only make a single transaction when depositing their funds to the vault. However, if the vault accept a DAI asset, and the user wanted to deposit their funds through depositWithPermit() their transaction will fail/revert. This can happen because the function signature that the DAI.permit has and IERC20Permit.permit has is different.

Proof of Concept

IERC20Permit = https://github.com/OpenZeppelin/openzeppelin-contracts/blob/master/contracts/token/ERC20/extensions/IERC20Permit.sol#L66-L74

    function permit(
        address owner,
        address spender,
        uint256 value,
        uint256 deadline,
        uint8 v,
        bytes32 r,
        bytes32 s
    ) external;

ETHEREUM.DAI = https://etherscan.io/token/0x6b175474e89094c44da98b954eedeac495271d0f#code

     function permit(
        address holder, 
        address spender, 
        uint256 nonce, 
        uint256 expiry,
        bool allowed, 
        uint8 v, 
        bytes32 r, 
        bytes32 s
     ) external;

Tools Used

Manual

Assessed type

Context