Skip to content

Latest commit

 

History

History
78 lines (58 loc) · 2.72 KB

012.md

File metadata and controls

78 lines (58 loc) · 2.72 KB

Cheery Holographic Swift

Medium

Stable coins can be burnt below the minimum limit.

Summary

The AmirX::defiToStablecoinSwap() function updates the ss.oAmount after verifying minimum burn limit. Therefore, stable coins can be burnt below the minimum limit.

Root Cause

The AmirX::defiToStablecoinSwap() updates the ss.oAmount after verifying minimum burn limit as follows.

    function defiToStablecoinSwap(
        address wallet,
        StablecoinSwap memory ss,
        DefiSwap memory defi
    ) external payable onlyRole(SWAPPER_ROLE) whenNotPaused {
        // checks if defi will fail
        _verifyDefiSwap(wallet, defi);
        // checks if stablecoin swap will fail
119:     _verifyStablecoinSwap(wallet, ss);

        //check balance to adjust second swap
        uint256 iBalance = ERC20(ss.origin).balanceOf(wallet);
        _defiSwap(wallet, defi);
        uint256 fBalance = ERC20(ss.origin).balanceOf(wallet);
125:    ss.oAmount = fBalance - iBalance;
        //change balance to reflect change
        _stablecoinSwap(wallet, ss);
    }

As shown above, the function updates ss.oAmount as the difference in the wallet's origin balance at line 125. However, ss.oAmount was already verified at the following _verifyStablecoinSwap() on line 119.

    function _verifyStablecoinSwap(
        address wallet,
        StablecoinSwap memory ss
    ) internal view nonZero(ss) {
        ------ SKIP ------
            // Ensure the total supply does not drop below the minimum limit after burning the specified amount.
            if (
205:            Stablecoin(ss.origin).totalSupply() - ss.oAmount <
                getMinLimit(ss.origin)
            ) revert InvalidMintBurnBoundry(ss.origin, ss.oAmount);
        ------ SKIP ------
    }

As a result, the condition on line 205 is bypassed.

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

  1. Suppose that total supply of ss.origin is 2 ether and the minimum burn limit of ss.origin is 1 ether.
  2. A user calls AmirX::defiToStablecoinSwap() with ss.oAmount = 1 ether.
  3. ss.oAmount is updated to 2 ether at line 125.
  4. As a result of the tx, total supply of ss.origin will drop to zero which is less than the minimum burn limit.

Impact

Broken functionality as the stable coins can be burnt below the minimum limit set by the admin.

PoC

No response

Mitigation

Verify stable swap parameters after updating the ss.oAmount.