006.md

Proud Rusty Mantis

Medium

Incorrect modifier disallows swapping nuAssets

Vulnerability Detail

Upon minting and swapping nuAssets, we have the following modifier which disallows the aforementioned actions:

modifier notInWarningCF() {
    ...
}

The issue is that the modifier should not actually be applied when swapping as this doesn't decrease the CF.

Attack Path

1. User tries to mint nuAssets when the CF is in a warning state
2. As the CF will decrease, this correctly reverts (due to the nuAsset supply increasing while the rETH balance staying stationary)
3. User wants to swap between nuAssets when the CF is in a warning state
4. This will incorrectly revert despite the user not worsening the CF and even improving it (due to round downs)

Impact

Swapping is impossible when the CF is in a warning state even though it shouldn't be

Mitigation

Remove the modifier from the swapping functions