Skip to content

Latest commit

 

History

History
69 lines (48 loc) · 2.33 KB

089.md

File metadata and controls

69 lines (48 loc) · 2.33 KB

Formal Pecan Mongoose

Medium

Restricted access or functionality to getAmountIn

Summary

Restricted access or functionality to getAmountIn due to requirement of msg.sender being a contract and not an EOA. This means msg.sender cannot call this function and only contracts can call this function which is not intended.

Root Cause

https://github.com/sherlock-audit/2024-12-numa-audit/blob/main/Numa/contracts/lending/NumaLeverageVaultSwap.sol#L17C5-L41C6

In the getAmountIn function, function getAmountIn( uint256 _amount, bool _closePosition ) external view returns (uint256) { CNumaToken cNuma = vault.cNuma(); CNumaToken cLstToken = vault.cLstToken();

    if (
        ((msg.sender == address(cLstToken)) && (!_closePosition)) ||
        ((msg.sender == address(cNuma)) && (_closePosition))
    ) {
        uint amountIn = vault.getBuyNumaAmountIn(_amount);
        amountIn = amountIn + (amountIn * slippage) / 1 ether;
        return amountIn;
    } else if (
        ((msg.sender == address(cNuma)) && (!_closePosition)) ||
        ((msg.sender == address(cLstToken)) && (_closePosition))
    ) {
        uint amountIn = vault.getSellNumaAmountIn(_amount);
        amountIn = amountIn + (amountIn * slippage) / 1 ether;
        return amountIn;
    } else {
        revert("not allowed");
    }
}

The function uses msg.sender to determine the control flow in both getAmountIn and swap functions.

The conditions check if msg.sender is equal to the addresses of cNuma or cLstToken, which are contracts, not users. Regular users cannot interact with these functions because their addresses will not match the contract addresses of cNuma or cLstToken. Relying on msg.sender being a specific contract is not secure, as contracts can be spoofed or proxies can change addresses.

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

This restricts functionality of the function. regular users won't be able to call it

PoC

No response

Mitigation

Use access control libraries or patterns, such as OpenZeppelin's Ownable or AccessControl, to manage permissions. Define roles or permissions that specify which addresses (users or contracts) can call these functions.