PoolTogether - Timenov's results

Lines of code

https://github.com/code-423n4/2024-03-pooltogether/blob/480d58b9e8611c13587f28811864aea138a0021a/pt-v5-vault/src/PrizeVault.sol#L540

Vulnerability details

Impact

The depositWithPermit function will not work as expected if the _asset does not support the permit functionality.

Proof of Concept

Some tokens(for example WETH and stETH) do not have a permit function and others(for example DAI) utilizes a permit function that deviates from the reference implementation.

This means that the permit will execute, but the allowance will not be correct, resulting in unexpected behaviour. The tokens above are widely used so it is likely for them to be the _asset of the vault. Also there are more tokens that have the same issues.

Tools Used

Manual Review

Recommended Mitigation Steps

Consider adding a validation after the permit to check if the allowance is correct and revert with a message if not.

    require(_asset.allowance(_owner, address(this)) >= _assets, "Allowance with permit failed.");

Assessed type

Error