Cudos contest - wuwe1's results

Lines of code

https://github.com/code-423n4/2022-05-cudos/blob/main/solidity/contracts/Gravity.sol#L600

Vulnerability details

Impact

Since the _tokenContract can be any token, it is possible that loans will be created with tokens that support fee on transfer. If a fee on transfer asset token is chosen, other user's funds might be drained.

Proof of Concept

1. Assume transfer fee to be 5% and Gravity.sol has 200 token.
2. Alice sendToCosmos 100 token. Now, Gravity.sol has 295 token.
3. Alice calls the send-to-eth method to withdraw 100 token.
4. Gravity.sol ends up having 195 token.

Recommended Mitigation Steps

change to

	function sendToCosmos(
		address _tokenContract,
		bytes32 _destination,
		uint256 _amount
	) public nonReentrant  {
                uint256 oldBalance = IERC20(_tokenContract).balanceOf(address(this));
		IERC20(_tokenContract).safeTransferFrom(msg.sender, address(this), _amount);
                uint256 receivedAmout = IERC20(_tokenContract).balanceOf(address(this)) - oldBalance;
		state_lastEventNonce = state_lastEventNonce.add(1);
		emit SendToCosmosEvent(
			_tokenContract,
			msg.sender,
			_destination,
			receivedAmout,
			state_lastEventNonce
		);
	}