Skip to content

Latest commit

 

History

History
103 lines (69 loc) · 5.33 KB

053.md

File metadata and controls

103 lines (69 loc) · 5.33 KB

Precise Pistachio Owl

Medium

WETH token on Metis does not have deposit() and withdraw() functions

Summary

WrappedTokenGatewayV3 is to be deployed on Metis blockchain as listed in the contract scope. Across several of its functions, it calls WETH.deposit() and WETH.withdraw(), but these functions are not part of the functions for WETH token on Metis.

Root Cause

WETH token on METIS does not have any functions named deposit() and withdraw().

explorer link: https://explorer.metis.io/token/0x420000000000000000000000000000000000000A/contract/writeContract

This causes the functions depositETH(), withdrawETH(), repayETH(), borrowETH(), withdrawETHWithPermit() to all revert because they all try to call WETH.deposit() or WETH.withdraw() in their logic.

Internal Pre-conditions

  1. WrappedTokenGatewayV3 gets deployed on METIS mainnet.
  2. 0x420000000000000000000000000000000000000A which is the WETH on METIS is set as WETH variable in contract during deployment.

External Pre-conditions

No response

Attack Path

  1. WrappedTokenGatewayV3 gets deployed on METIS mainnet.
  2. 0x420000000000000000000000000000000000000A which is the WETH on METIS is set as WETH variable in contract during deployment.
  3. Calls to depositETH(), withdrawETH(), repayETH(), borrowETH(), withdrawETHWithPermit() gets reverted.

Impact

The contract WrappedTokenGatewayV3 is unuseable on METIS because the WETH contract there has no deposit() and withdraw().

PoC

run with forge test --mt test_InvalidFunctionWethCallOnMetis --fork-url $RPC_METIS -vvvvv

// SPDX-License-Identifier: BUSL-1.1
pragma solidity ^0.8.0;

import 'forge-std/Test.sol';
import {AaveOracle} from '../../src/contracts/misc/AaveOracle.sol';
import {WrappedTokenGatewayV3} from '../../src/contracts/helpers/WrappedTokenGatewayV3.sol';
import {AaveProtocolDataProvider} from '../../src/contracts/helpers/AaveProtocolDataProvider.sol';
import {AToken} from '../../src/contracts/protocol/tokenization/AToken.sol';
import {VariableDebtToken} from '../../src/contracts/protocol/tokenization/VariableDebtToken.sol';
import {DataTypes} from '../../src/contracts/protocol/libraries/types/DataTypes.sol';
import {EIP712SigUtils} from '../utils/EIP712SigUtils.sol';
import {TestnetProcedures} from '../utils/TestnetProcedures.sol';
import '../../src/deployments/interfaces/IMarketReportTypes.sol';

contract WrappedTokenGatewayTests is TestnetProcedures {
  WrappedTokenGatewayV3 internal wrappedTokenGatewayV3;

  uint256 internal depositSize = 5e18;
  uint256 internal usdxSize = 10000e18;
  address WETH = 0x420000000000000000000000000000000000000A;
  address owner = makeAddr('owner');
  address POOL = makeAddr('POOL');

  function setUp() public {
    wrappedTokenGatewayV3 = new WrappedTokenGatewayV3(WETH, owner, IPool(POOL));
  }

  function test_InvalidFunctionWethCallOnMetis() public {
    vm.deal(alice, 100e18);
    vm.prank(alice);
    wrappedTokenGatewayV3.depositETH{value: depositSize}(report.poolProxy, alice, 0);
  }
}

Output is as seen below

  [31864] WrappedTokenGatewayTests::test_InvalidFunctionWethCallOnMetis()
    ├─ [0] VM::deal(0x0000000000000000000000000000000000000000, 100000000000000000000 [1e20])
    │   └─ ← [Return] 
    ├─ [0] VM::prank(0x0000000000000000000000000000000000000000)
    │   └─ ← [Return] 
    ├─ [10043] WrappedTokenGatewayV3::depositETH{value: 5000000000000000000}(0x0000000000000000000000000000000000000000, 0x0000000000000000000000000000000000000000, 0)
    │   ├─ [45] OVM_ETH::deposit{value: 5000000000000000000}()
    │   │   └─ ← [Revert] EvmError: Revert
    │   └─ ← [Revert] EvmError: Revert
    └─ ← [Revert] EvmError: Revert

Suite result: FAILED. 0 passed; 1 failed; 0 skipped; finished in 3.16s (1.78ms CPU time)

Call fails at WETH.deposit{value: msg.value}(); call in WrappedTokenGatewayV3.depositETH(). OVM_ETH is the name of the token contract designated to be WETH on METIS.

Mitigation

No response