Platform: Code4rena
Start Date: 24/03/2022
Pot Size: $75,000 USDC
Total HM: 15
Participants: 59
Period: 7 days
Judge: gzeon
Id: 103
League: ETH
Rank: 41/59
Findings: 2
Award: $177.72
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: hake
Also found by: 0v3rf10w, 0xDjango, 0xkatana, BouSalman, CertoraInc, Dravee, Hawkeye, IllIllI, JMukesh, Jujic, Kenshin, PPrieditis, Picodes, PranavG, Ruhum, SolidityScan, VAD37, WatchPug, aga7hokakological, catchup, csanuragjain, cthulhu_cult, defsec, dimitri, hickuphh3, hubble, hyh, kenta, kirk-baird, obront, peritoflores, rayn, robee, saian, samruna, shenwilly, shw, sorrynotsorry, tchkvsky, teryanarmen, ych18
116.1812 USDC - $116.18
transferERC20 says, on L76Address to send ether to This should read something like "Address to send token to"
Possible to leave funds in contract
The general flows indicate that funds supposed to be moved into and out of these contracts in a single tx. However, in addition to the general possibility that someone sends some ERC20 to this contract, swap allows for a poorly constructed swap to transfer in more tokens than are used in the swap.
Possible to trade with funds others have left in the contracts
Given I can pass in any calldata to swap, I could trade with whatever tokens are in the contract at the time of me tx: it does not have to be fromAssetId and toAssetId.
Given all of the above, AssetSwapped event log could end up being very misleading. I could trade with more than fromAmount and thus throw off the toAmount/toAmount ratio.
#0 - H3xept
2022-04-08T09:19:18Z
🌟 Selected for report: Dravee
Also found by: 0v3rf10w, 0xDjango, 0xNazgul, 0xkatana, ACai, CertoraInc, FSchmoede, Funen, Hawkeye, IllIllI, Jujic, Kenshin, PPrieditis, Picodes, SolidityScan, TerrierLover, Tomio, WatchPug, catchup, csanuragjain, defsec, dimitri, hake, hickuphh3, kenta, minhquanym, obront, peritoflores, rayn, rfa, robee, saian, samruna, tchkvsky, teryanarmen, ych18
61.5429 USDC - $61.54
All occurrences of == true can be removed and 23 gas will be saved in each case, with entirely equivalent execution. Occurs in
DexManagerFacet: L20, L34
Swapper: L16
#0 - H3xept
2022-04-08T15:23:56Z
Duplicate if #39