Good Entry - SpicyMeatball's results

Lines of code

https://github.com/code-423n4/2023-08-goodentry/blob/main/contracts/TokenisableRange.sol#L159-L160 https://github.com/code-423n4/2023-08-goodentry/blob/main/contracts/RangeManager.sol#L100

Vulnerability details

Impact

When initializing a new tokenisable range contract, the admin should send some amounts of token0 and token1 to the TokenisableRange contract to mint and create a new position on Uniswap,

https://github.com/code-423n4/2023-08-goodentry/blob/main/contracts/TokenisableRange.sol#L142

in some cases there will be spare amounts of tokens that weren't added to the liquidity, they are refunded back to the RangeManager contract.

https://github.com/code-423n4/2023-08-goodentry/blob/main/contracts/TokenisableRange.sol#L159-L160

But unlike tr tokens

https://github.com/code-423n4/2023-08-goodentry/blob/main/contracts/RangeManager.sol#L101

they are not forwarded to the admin wallet after that and remain at the RangeManager balance, until cleanup won't deposit it to some user.

https://github.com/code-423n4/2023-08-goodentry/blob/main/contracts/RangeManager.sol#L190

Proof of Concept

see above

Tools Used

Manual review

Recommended Mitigation Steps

Maybe it will be better to add additional parameter to the init function

https://github.com/code-423n4/2023-08-goodentry/blob/main/contracts/TokenisableRange.sol#L134

function init(uint n0, uint n1, address to) external {
    ...
    TOKEN0.token.safeTransfer(to,  TOKEN0.token.balanceOf(address(this)));
    TOKEN1.token.safeTransfer(to, TOKEN1.token.balanceOf(address(this)));
    _mint(to, 1e18);
    emit Deposit(to, 1e18);

and call

https://github.com/code-423n4/2023-08-goodentry/blob/main/contracts/RangeManager.sol#L100

TokenisableRange(tr).init(amount0, amount1, msg.sender);

Assessed type

Token-Transfer