Badger-Vested-Aura contest - cccz's results

Lines of code

https://github.com/Badger-Finance/vested-aura/blob/main/contracts/MyStrategy.sol#L249

Vulnerability details

Impact

There is no slippage control on _harvest, which expose strategy to sandwich attack.

            uint256 balEthBptEarned = BALANCER_VAULT.swap(singleSwap, fundManagement, 0, type(uint256).max);
...
            harvested[0].amount = BALANCER_VAULT.swap(singleSwap, fundManagement, 0, type(uint256).max);
...
    function swap(
        SingleSwap memory singleSwap,
        FundManagement memory funds,
        uint256 limit,
        uint256 deadline
    ){
    ...
            _require(singleSwap.kind == SwapKind.GIVEN_IN ? amountOut >= limit : amountIn <= limit, Errors.SWAP_LIMIT);

Proof of Concept

https://github.com/Badger-Finance/vested-aura/blob/main/contracts/MyStrategy.sol#L249 https://github.com/Badger-Finance/vested-aura/blob/main/contracts/MyStrategy.sol#L275

Tools Used

None

Recommended Mitigation Steps

Use an oracle to get the limit

Lines of code

https://github.com/Badger-Finance/vested-aura/blob/v0.0.2/contracts/MyStrategy.sol#L428-L431

Vulnerability details

Impact

The _sendBadgerToTree function will call the _processExtraToken function after sending the BADGER token to the BADGER_TREE, and the _processExtraToken function will send the BADGER token to the vault again.

     function _processExtraToken(address _token, uint256 _amount) internal {
         require(_token != want, "Not want, use _reportToVault");
         require(_token != address(0), "Address 0");
         require(_amount != 0, "Amount 0");

         IERC20Upgradeable(_token).safeTransfer(vault, _amount);
         IVault(vault).reportAdditionalToken(_token);
     }

In the sweepRewardToken function, the execution fails because the amount of BADGER tokens sent is the contract balance. In the claimBribesFromHiddenHand function, BADGER tokens are sent twice.

Proof of Concept

https://github.com/Badger-Finance/vested-aura/blob/v0.0.2/contracts/MyStrategy.sol#L428-L431

Tools Used

None

Recommended Mitigation Steps

    function _sendBadgerToTree(uint256 amount) internal {
        IERC20Upgradeable(BADGER).safeTransfer(BADGER_TREE, amount);
-       _processExtraToken(address(BADGER), amount);
    }