GoGoPool contest - Qeew's results

Lines of code

https://github.com/code-423n4/2022-12-gogopool/blob/aec9928d8bdce8a5a4efe45f54c39d4fc7313731/contracts/contract/tokens/upgradeable/ERC4626Upgradeable.sol#L42

Vulnerability details

Impact

Detailed description of the impact of this finding.

A bad actor can exploit the Vault by depositing a small amount of asset tokens (1 wei) and receiving 1 wei of shares tokens. The attacker can then send a large amount of asset tokens (10000e18 - 1) to inflate the price per share (1.0000 to an extreme value of 1.0000e22). This would cause future users who deposit 19999e18 to only receive 1 wei of shares tokens when they redeem, resulting in a loss of 9999e18 or half of their deposits.

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.

https://github.com/code-423n4/2022-12-gogopool/blob/main/contracts/contract/tokens/upgradeable/ERC4626Upgradeable.sol

Tools Used

Manual Code Review

Recommended Mitigation Steps

To fix this, it is recommended to require a minimum amount of share tokens to be minted for the first minter and to set aside a portion of the initial mints as a permanent reserve to make the price per share more resistant to manipulation.