Basin - Udsen's results

Lines of code

https://github.com/code-423n4/2023-07-basin/blob/main/src/Well.sol#L413-L444

Vulnerability details

Impact

In the Well._addLiquidity() function there is no check on array length equality between tokenAmountsIn array and the _tokens array. Since the _addLiquidity function uses for loop to iterate through the array elements of both tokenAmountsIn and _tokens arrays, any array length mismatch could revert the transaction during execution. Hence this would waste lot of gas for the user. Hence user will lose funds as a result.

The same vulnerability can be seen in the following functions as well. Well.removeLiquidity() Well.removeLiquidityImbalanced()

Proof of Concept

    function _addLiquidity(
        uint256[] memory tokenAmountsIn,
        uint256 minLpAmountOut,
        address recipient,
        bool feeOnTransfer
    ) internal returns (uint256 lpAmountOut) {
        IERC20[] memory _tokens = tokens();
        uint256[] memory reserves = _updatePumps(_tokens.length);

        if (feeOnTransfer) {
            for (uint256 i; i < _tokens.length; ++i) {
                if (tokenAmountsIn[i] == 0) continue;
                tokenAmountsIn[i] = _safeTransferFromFeeOnTransfer(_tokens[i], msg.sender, tokenAmountsIn[i]);
                reserves[i] = reserves[i] + tokenAmountsIn[i];
            }
        } else {
            for (uint256 i; i < _tokens.length; ++i) {
                if (tokenAmountsIn[i] == 0) continue;
                _tokens[i].safeTransferFrom(msg.sender, address(this), tokenAmountsIn[i]);
                reserves[i] = reserves[i] + tokenAmountsIn[i];
            }
        }

        lpAmountOut = _calcLpTokenSupply(wellFunction(), reserves) - totalSupply();
        if (lpAmountOut < minLpAmountOut) {
            revert SlippageOut(lpAmountOut, minLpAmountOut);
        }

        _mint(recipient, lpAmountOut);
        _setReserves(_tokens, reserves);
        emit AddLiquidity(tokenAmountsIn, lpAmountOut, recipient);
    }

https://github.com/code-423n4/2023-07-basin/blob/main/src/Well.sol#L413-L444

Tools Used

Manual Review and VSCode

Recommended Mitigation Steps

Hence it is recommended to add the array length check between above mentioned tokenAmountsIn and _tokens arrays at the beginning of the _addLiquidity function. So that, in the event of an array length mismatch the transaction will revert at the very beginning before going into for loop execution. This will save the user on gas wastage.

Assessed type

Invalid Validation