Skip to content

Latest commit

 

History

History
36 lines (19 loc) · 1.45 KB

053.md

File metadata and controls

36 lines (19 loc) · 1.45 KB

Overt Tweed Stork

High

DefiSwap.plugIn can never collect referralFee from AmirX contract i.e reward distribution will be failed

Summary

referralFee amount of Telcoin is transferred to DefiSwap.defiSafe during fee dispersal, for this reason the SimplePlugin contract can't transfer the referralFee from AmirX contact in spite of having approval for the amount.

Root Cause

The root cause of the issue is the referralFee is transferred to the DefiSwap.defiSafe just after approving the SimplePlugin/DefiSwap.plugin contract.

Internal pre-conditions

None.

External pre-conditions

None.

Attack Path

There is no attack path because it is a business logic bug, In _feeDispersal() the plugin contract is approved by the AmirX contract for the referralFee amount. But just after the approval all Telcoin of the AmirX contract is sent to the DefiSwap.defiSafe, for that reason the AmirX contract does not have any Telcoin left in it's balance. Now when the plugin contract will try to transfer referralFee amount of Telcoin from the AmirX contact then the tx will be failed with ERC20InsufficientBalance error because the AmirX contract does not have enough Telcoin to transfer.

Impact

Reward distribution will fail.

PoC

https://github.com/sherlock-audit/2024-11-telcoin/blob/b9c751b59e78a7123a636e31ecafc9147046f190/telcoin-audit/contracts/swap/AmirX.sol#L194-L213

Mitigation

Instead of approving the plugin transfer the referralFee to it.