Timeswap contest - mert_eren's results

Lines of code

https://github.com/code-423n4/2023-01-timeswap/blob/ef4c84fb8535aad8abd6b67cc45d994337ec4514/packages/v2-option/src/TimeswapV2Option.sol#L109-L194

Vulnerability details

Impact

Proof of Concept

There is no barrier for using rebase tokens as option in system. So it can be used a rebase token for option contract by someone. Option contract user balances and total balances records is stabil just change with update(mint,collect,burn,swap) functions. However rebased tokens like ampleforth change balance of users(so option contract too) in periods and this will change contract balance without recorded.After rebase if total supply of coin increase, there will be some token will stuck.If total supply decrease there is recorded more token than contract has and this may effects some people cant take their money and see unexpected reverts from this contract.

Tools Used

Recommended Mitigation Steps

there should be a block or warning for using of rebase tokens.Another way is, special mechanism for changing record with contract balance for this type of tokens.