Sherlock contest - cccz's results

Handle

cccz

Vulnerability details

Impact

In the deposit function, when want.allowance(address(this), address(lp)) < amount, the contract should call want.safeApprove(address(lp), 0);

Proof of Concept

https://github.com/code-423n4/2022-01-sherlock/blob/main/contracts/managers/AaveV2Strategy.sol#L70-L72

Tools Used

Manual analysis

Recommended Mitigation Steps

  function deposit() external override whenNotPaused {
    ILendingPool lp = getLp();
    // Checking the USDC balance of this contract
    uint256 amount = want.balanceOf(address(this));
    if (amount == 0) revert InvalidConditions();

    // If allowance for this contract is too low, approve the max allowance
    if (want.allowance(address(this), address(lp)) < amount) {
+   want.safeApprove(address(lp), 0);
      want.safeApprove(address(lp), type(uint256).max);
    }

    // Deposits the full balance of USDC held in this contract into Aave's lending pool
    lp.deposit(address(want), amount, address(this), 0);
  }

Handle

cccz

Vulnerability details

Impact

Same as https://github.com/code-423n4/2021-11-overlay-findings/issues/79

The SherBuy contract assumes that _sher is sher and _usdc is usdc, the SherClaim contract assumes that _sher is sher, the Sherlock contract assumes that _sher is sher and _token is usdc, but does not check it in the constructor. If the input address does not meet the assumptions, which could lead to wrong market liquidity and prices calculations.

Proof of Concept

https://github.com/code-423n4/2022-01-sherlock/blob/main/contracts/SherBuy.sol#L68-L101

https://github.com/code-423n4/2022-01-sherlock/blob/main/contracts/SherClaim.sol#L39-L47

https://github.com/code-423n4/2022-01-sherlock/blob/main/contracts/Sherlock.sol#L77-L118

Tools Used

Manual analysis

Recommended Mitigation Steps

Check if the input address matches the assumption