Skip to content

Latest commit

 

History

History
85 lines (66 loc) · 4.49 KB

031.md

File metadata and controls

85 lines (66 loc) · 4.49 KB

Low Tangerine Cod

High

users will not be able to withdraw their funds due to underflow(collateralTokenTransferData.ethToSend)

Summary

users will not be able to withdraw their funds due to underflow uint128(2 * feeForTokenTransfer.nativeFee + (feeForCollateralTransfer.nativeFee - collateralTokenTransferData.ethToSend))

Root Cause

Whenever users attempt to withdraw, there may not always be enough ETH in the current chain, resulting in a request to retrieve it from another chain.

                    interfaces.globalVariables.oftOrCollateralReceiveFromOtherChains{
                        value: msg.value - params.fee
                    }(
                        IGlobalVariables.FunctionToDo(
                            // Call getLzFunctionToDo in cds library to get, which action needs to do in dst chain
                            getLzFunctionToDo(params.optionsFeesToGetFromOtherChain, collateralToGetFromOtherChain)
                        ),
                        IGlobalVariables.USDaOftTransferData(address(interfaces.treasury), params.optionsFeesToGetFromOtherChain),
                        IGlobalVariables.CollateralTokenTransferData(
                            address(interfaces.treasury),
-->                            ethAmountFromOtherChain,
                            weETHAmountFromOtherChain,
                            rsETHAmountFromOtherChain
                        ),
                        IGlobalVariables.CallingFunction.CDS_WITHDRAW,
                        msg.sender
                    );

Blockchian/contracts/lib/CDSLib.sol#L789

This amount is significant in case liquidation happening compare to the fees that protocol pays for layer0 to withdraw that amount from other chain, right? But this is exactly is what will happen when user decides to withdraw his funds: 2 * feeForTokenTransfer.nativeFee + (feeForCollateralTransfer.nativeFee - collateralTokenTransferData.ethToSend underflow

        } else if (functionToDo == FunctionToDo.COLLATERAL_TRANSFER) {
            // Define options with native fee required in dst chain
            // to transfer this collaterals using 'addExecutorNativeDropOption' with fee amount and this chain address where to get
            _options = OptionsBuilder.newOptions().addExecutorLzReceiveOption(300000, 0).addExecutorNativeDropOption(
                    // Since, we have 3 collaterals, we are passing native fee required for 2 OFT transfers
                    // and 1 native transfer,so we are multiplying oft fee with 2.
                    // Since feeForCollateralTransfer includes the fee with native token needed, we are subtracting the native token
                    // needed to get the fee alone
-->                    uint128(2 * feeForTokenTransfer.nativeFee + (feeForCollateralTransfer.nativeFee - collateralTokenTransferData.ethToSend)),
                    bytes32(uint256(uint160(dstGlobalVariablesAddress)))
                );
            // If we need to get both the Collaterals and USDa from dst chain
        } else if (functionToDo == FunctionToDo.BOTH_TRANSFER) {
            _options = OptionsBuilder.newOptions().addExecutorLzReceiveOption(700000, 0).addExecutorNativeDropOption(
                    // Since, we have 3 collaterals, we are passing native fee required for 3 OFT transfers
                    // and 1 native transfer,so we are multiplying oft fee with 3.
                    // Since feeForCollateralTransfer includes the fee with native token needed, we are subtracting the native token
                    // needed to get the fee alone
-->                    uint128(5 * feeForTokenTransfer.nativeFee + (feeForCollateralTransfer.nativeFee - collateralTokenTransferData.ethToSend)),
                    bytes32(uint256(uint160(dstGlobalVariablesAddress)))
                );
        }

Core_logic/GlobalVariables.sol#L290

Internal pre-conditions

Liquidation happen, user's position requires eth from other chain

External pre-conditions

No response

Attack Path

Users decide to withdraw their funds in cds

Impact

User's will not be able to withdraw their funds, locked funds

PoC

No response

Mitigation

Handle underflow that will happen, im not sure why collateralTokenTransferData.ethToSend is there in formula