FEI and TRIBE Redemption contest - ak1's results

Lines of code

https://github.com/code-423n4/2022-09-tribe/blob/769b0586b4975270b669d7d1581aa5672d6999d5/contracts/shutdown/redeem/TribeRedeemer.sol#L29 https://github.com/code-423n4/2022-09-tribe/blob/769b0586b4975270b669d7d1581aa5672d6999d5/contracts/shutdown/redeem/TribeRedeemer.sol#L71-L73

Vulnerability details

Impact

User input error (adding the same token again in an array of token), can cause the double spend issue..

Proof of Concept

https://github.com/code-423n4/2022-09-tribe/blob/769b0586b4975270b669d7d1581aa5672d6999d5/contracts/shutdown/redeem/TribeRedeemer.sol#L29

constructor(
    address _redeemedToken,
    address[] memory _tokensReceived,
    uint256 _redeemBase
) {
    redeemedToken = _redeemedToken;
    tokensReceived = _tokensReceived;
    redeemBase = _redeemBase;
}

Here the double spend can happen. https://github.com/code-423n4/2022-09-tribe/blob/769b0586b4975270b669d7d1581aa5672d6999d5/contracts/shutdown/redeem/TribeRedeemer.sol#L71-L73

function redeem(address to, uint256 amountIn) external nonReentrant {
    IERC20(redeemedToken).safeTransferFrom(msg.sender, address(this), amountIn);


    (address[] memory tokens, uint256[] memory amountsOut) = previewRedeem(amountIn);


    uint256 base = redeemBase;
    redeemBase = base - amountIn; // decrement the base for future redemptions
    for (uint256 i = 0; i < tokens.length; i++) {
        IERC20(tokens[i]).safeTransfer(to, amountsOut[i]);
    }


    emit Redeemed(msg.sender, to, amountIn, base);
}

Tools Used

Manual code review

Recommended Mitigation Steps

during the contract deployment, add validation to ensure that same token is not added in the token array.