Lybra Finance - SovaSlava's results

A protocol building the first interest-bearing omnichain stablecoin backed by LSD.

General Information

Platform: Code4rena

Start Date: 23/06/2023

Pot Size: $60,500 USDC

Total HM: 31

Participants: 132

Period: 10 days

Judge: 0xean

Total Solo HM: 10

Id: 254

League: ETH

Lybra Finance

Findings Distribution

Researcher Performance

Rank: 126/132

Findings: 1

Award: $1.32

🌟 Selected for report: 0

🚀 Solo Findings: 0

Awards

1.3247 USDC - $1.32

Labels

bug
2 (Med Risk)
downgraded by judge
satisfactory
duplicate-27

External Links

Lines of code

https://github.com/code-423n4/2023-06-lybra/blob/7b73ef2fbb542b569e182d9abf79be643ca883ee/contracts/lybra/pools/LybraWbETHVault.sol#L23 https://github.com/code-423n4/2023-06-lybra/blob/7b73ef2fbb542b569e182d9abf79be643ca883ee/contracts/lybra/pools/LybraWbETHVault.sol#L35

Vulnerability details

Impact

Contract have interface of WBETH contract, which have of 2 function: exchangeRatio() and deposit(). In contract code we can see address of contract, which will be used as address for interface - 0xae78736Cd615f374D3085123A210448E74Fc6393 https://github.com/code-423n4/2023-06-lybra/blob/7b73ef2fbb542b569e182d9abf79be643ca883ee/contracts/lybra/pools/LybraWbETHVault.sol#L16

Contract dont have functions exchangeRatio() and deposit(). So, any calls will revert.

Proof of Concept

Check external functions: https://etherscan.io/address/0xae78736Cd615f374D3085123A210448E74Fc6393#writeContract

Tools Used

Manual review

Use right functions

Assessed type

Other

#0 - c4-pre-sort

2023-07-08T14:20:57Z

JeffCX marked the issue as duplicate of #27

#1 - c4-judge

2023-07-28T17:14:12Z

0xean changed the severity to 2 (Med Risk)

#2 - c4-judge

2023-07-28T17:15:35Z

0xean marked the issue as satisfactory

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter