Wise Lending - Rhaydden's results

Lines of code

https://github.com/code-423n4/2024-02-wise-lending/blob/79186b243d8553e66358c05497e5ccfd9488b5e2/contracts/TransferHub/TransferHelper.sol#L13-L52 https://github.com/code-423n4/2024-02-wise-lending/blob/79186b243d8553e66358c05497e5ccfd9488b5e2/contracts/TransferHub/ApprovalHelper.sol#L13-L29

Vulnerability details

Impact

The _callOptionalReturn function in both ApprovalHelper.sol and TransferHelper.sol returns a boolean indicating the success or failure of the low-level call. But, this return value is not checked/not used at all in these contracts. This means that if the low-level call fails for any reason (e.g., due to a revert in the called contract, the failure will not be caught or handled by the calling contracts. This could lead to unexpected behavior or potential security vulnerabilities, as the contracts may continue executing under the assumption that the call was successful.

The contracts that import the Approvalhelper.sol contract include:

• WiseSecurity.sol
• AaveHub.sol
• PendlePowerFarmDeclarations.sol
• PendlePowerFarmControllerBase.sol

The contracts that import the Transferhelper.sol contract include:

• AaveHub.sol
• PendlePowerFarmDeclarations.sol
• PendlePowerFarmControllerBase.sol
• PendlePowerFarmToken.sol
• WiseCore.sol
• FeeManagerHelper.sol

TransferHub is the directory which includes contracts intending to move funds securely. Leaving it unchecked leaves the entire codebase vulnerable.

Proof of Concept

ApprovalHelper.sol: The _safeApprove function calls _callOptionalReturn but does not check the return value.

TransferHelper.sol: Both _safeTransfer and _safeTransferFrom functions call _callOptionalReturn without checking the return.

Tools Used

VScode

Recommended Mitigation Steps

Check Return Value: Modify the _safeApprove, _safeTransfer, and _safeTransferFrom functions to check the return value of _callOptionalReturn. If the call fails, the functions should revert or handle the failure appropriately. Example modification for _safeApprove:

   function _safeApprove(
       address _token,
       address _spender,
       uint256 _value
   )
       internal
   {
       bool success = _callOptionalReturn(
           _token,
           abi.encodeWithSelector(
               IERC20.approve.selector,
               _spender,
               _value
           )
       );
       require(success, "Approval failed");
   }

Assessed type

Other