Amun contest - p4st13r4's results

Handle

p4st13r4

Vulnerability details

Impact

Contracts in the folder basket/contracts/singleJoinExit makes use of unsafe address.transfer() method.

The use of such function could have unintended outcomes on the eth being sent to the receiver. Funds can potentially be lost if:

1. The smart contract fails to implement the payable fallback function
2. The fallback function uses more than 2300 gas units

The latter situation may occur in the instance of gas cost changes. The impact would mean that any contracts receiving funds would potentially be unable to retrieve funds

Proof of Concept

Affected lines are here:

• contracts/basket/contracts/singleJoinExit/EthSingleTokenJoin.sol:37
• contracts/basket/contracts/singleJoinExit/EthSingleTokenJoinV2.sol:37
• contracts/basket/contracts/singleJoinExit/SingleNativeTokenExit.sol:93
• contracts/basket/contracts/singleJoinExit/SingleNativeTokenExitV2.sol:121

Tools Used

Editor

Recommended Mitigation Steps

Consider using address.call{value: v}("") and checking the return value or Openzeppelin Address library instead

Handle

p4st13r4

Vulnerability details

Impact

If a rebalance is done in more than one transaction, locking the basket at each transaction can be avoided.

Proof of Concept

Tools Used

Editor

Recommended Mitigation Steps

(a) Implement lock() method in RebalanceManager.sol, RebalanceManagerV2.sol, RebalanceManagerV3.sol as:

    function lock() external onlyRebalanceManager {
        basket.singleCall(
            address(basket),
            abi.encodeWithSelector(basket.setLock.selector, _block),
            0
        );
    }

Effectively making lockBasketData not needed.RebalanceManager.sol, RebalanceManagerV2.sol will need a new constructor argument uint256 _lockTime and a new state variable uint256 public lockTime.

(b) In RebalanceManager.sol, RebalanceManagerV2.sol, RebalanceManagerV3.sol remove the line lockBasketData(block.number + 30) at the beginning of rebalance method.

(c) On rebalance method first line in RebalanceManager.sol, RebalanceManagerV2.sol add require(basket.getLock(), "REQUIRE_LOCK") (as in contracts/basket/contracts/callManagers/RebalanceManagerV3.sol)

When performing a rebalance:

(d) Call RebalanceManager.lock().

(e) Perform the rebalance using the rebalance() method.