Skip to content

Latest commit

 

History

History
27 lines (20 loc) · 978 Bytes

014.md

File metadata and controls

27 lines (20 loc) · 978 Bytes

Proud Rusty Mantis

High

Incorrect conversion when swapping between nuAssets

Vulnerability Detail

Upon swapping between nuAssets, we use the following function for the conversion:

    function getNbOfNuAssetFromNuAsset(uint256 _nuAssetAmountIn, address _nuAssetIn, address _nuAssetOut) external view returns (uint256) {
        uint256 nuAssetOutPerETHmulAmountIn = nuAManager.ethToNuAsset(_nuAssetOut, _nuAssetAmountIn);
        uint256 tokensForAmount = nuAManager.nuAssetToEth(_nuAssetIn, nuAssetOutPerETHmulAmountIn);
        return tokensForAmount;
    }

The function is incorrect as we are converting like this: ETH -> nuAssetA -> ETH when it should be nuAssetA-> ETH -> nuAssetB.

Attack Path

  1. User swaps between tokens
  2. The conversion is completely incorrect

Impact

Incorrect conversion which can cause a protocol drain or users receiving much less than supposed to

Mitigation

Convert like nuAssetA -> ETH -> nuAssetB