Good Entry - grearlake's results

Lines of code

https://github.com/code-423n4/2023-08-goodentry/blob/main/contracts/helper/V3Proxy.sol#L160-#L176 https://github.com/code-423n4/2023-08-goodentry/blob/main/contracts/helper/V3Proxy.sol#L178-#L194

Vulnerability details

Impact

User can loss eth that they should be received.

Proof of Concept

If function swapTokensForExactETH and swapExactTokensForETH is called by smart contract, It is possible that the receiver contract does not, intentionally or unintentionally, not implement the receive() or fallback() function to receiving ETH. But function does not revert since it is low-level call() function.

https://github.com/code-423n4/2023-08-goodentry/blob/main/contracts/helper/V3Proxy.sol#L160-#L176

function swapTokensForExactETH(uint amountOut, uint amountInMax, address[] calldata path, address to, uint deadline) payable external returns (uint[] memory amounts) {
    require(path.length == 2, "Direct swap only");
    require(path[1] == ROUTER.WETH9(), "Invalid path");
    ERC20 ogInAsset = ERC20(path[0]);
    ogInAsset.safeTransferFrom(msg.sender, address(this), amountInMax);
    ogInAsset.safeApprove(address(ROUTER), amountInMax);
    amounts = new uint[](2);
    amounts[0] = ROUTER.exactOutputSingle(ISwapRouter.ExactOutputSingleParams(path[0], path[1], feeTier, address(this), deadline, amountOut, amountInMax, 0));         
    amounts[1] = amountOut; 
    ogInAsset.safeApprove(address(ROUTER), 0);
    IWETH9 weth = IWETH9(ROUTER.WETH9());
    acceptPayable = true;
    weth.withdraw(amountOut);
    acceptPayable = false;
    payable(msg.sender).call{value: amountOut}("");
    emit Swap(msg.sender, path[0], path[1], amounts[0], amounts[1]); 
}

https://github.com/code-423n4/2023-08-goodentry/blob/main/contracts/helper/V3Proxy.sol#L178-#L194

function swapExactTokensForETH(uint amountIn, uint amountOutMin, address[] calldata path, address to, uint deadline) payable external returns (uint[] memory amounts) {
    require(path.length == 2, "Direct swap only");
    require(path[1] == ROUTER.WETH9(), "Invalid path");
    ERC20 ogInAsset = ERC20(path[0]);
    ogInAsset.safeTransferFrom(msg.sender, address(this), amountIn);
    ogInAsset.safeApprove(address(ROUTER), amountIn);
    amounts = new uint[](2);
    amounts[0] = amountIn;         
    amounts[1] = ROUTER.exactInputSingle(ISwapRouter.ExactInputSingleParams(path[0], path[1], feeTier, address(this), deadline, amountIn, amountOutMin, 0));
    ogInAsset.safeApprove(address(ROUTER), 0); 
    IWETH9 weth = IWETH9(ROUTER.WETH9());
    acceptPayable = true;
    weth.withdraw(amounts[1]);
    acceptPayable = false;
    payable(msg.sender).call{value: amounts[1]}("");
    emit Swap(msg.sender, path[0], path[1], amounts[0], amounts[1]);                 
}

Tools Used

Manual review.

Recommended Mitigation Steps

Implement check for response of call() in function swapTokensForExactETH and swapExactTokensForETH

Assessed type

Other