Good Entry - piyushshukla's results

Lines of code

https://github.com/code-423n4/2023-08-goodentry/blob/4b785d455fff04629d8675f21ef1d1632749b252/contracts/helper/V3Proxy.sol#L156

Vulnerability details

Impact

The swapETHForExactTokens and swapTokensForExactETH function performs a low-level .call in payable(msg.sender).call{value: amountOut}(""); , msg.sender.call{value: msg.value - amounts[0]}(""); but does not check the return value if the call succeeded.

If the call fails, the refunds did not succeed and the caller will lose all refunds of msg.value - amounts[0].

Proof of Concept

https://github.com/code-423n4/2023-08-goodentry/blob/4b785d455fff04629d8675f21ef1d1632749b252/contracts/helper/V3Proxy.sol#L156 msg.sender.call{value: msg.value - amounts[0]}(""); emit Swap(msg.sender, path[0], path[1], amounts[0], amounts[1]); } https://github.com/code-423n4/2023-08-goodentry/blob/4b785d455fff04629d8675f21ef1d1632749b252/contracts/helper/V3Proxy.sol#L174C1-L175C1

    payable(msg.sender).call{value: amountOut}("");
    emit Swap(msg.sender, path[0], path[1], amounts[0], amounts[1]); 

Tools Used

manual

Recommended Mitigation Steps

Revert the entire transaction if the refund call fails by checking that the success return value of the payable(to).call(...) returns true.

Assessed type

call/delegatecall