Trader Joe v2 contest - d3e4's results

Lines of code

https://github.com/code-423n4/2022-10-traderjoe/blob/79f25d48b907f9d0379dd803fc2abc9c5f57db93/src/LBRouter.sol#L520

Vulnerability details

Impact

swapAVAXForExactTokens can only be called with the exact amount of AVAX.

Proof of Concept

At LBRouter.sol#L520 any excess sent is supposed to be refunded, i.e. if msg.value > amountsIn[0], but the amount to be refunded is calculated as amountsIn[0] - msg.value:

if (msg.value > amountsIn[0]) _safeTransferAVAX(_to, amountsIn[0] - msg.value);

Tools Used

Code inspection

Recommended Mitigation Steps

Invert amountsIn[0] - msg.value to the correct msg.value - amountsIn[0].