Skip to content

Latest commit

 

History

History
93 lines (68 loc) · 2.38 KB

056.md

File metadata and controls

93 lines (68 loc) · 2.38 KB

Amusing Heather Cottonmouth

Medium

_feeDispersal() could be broken (if (address(feeToken) == address(0)) in _buyBack() )and need to pay for referrer with referralFee > 0

Summary

In AmirX.sol, return after checking (address(feeToken) == address(0)) in _buyBack could break the functionality in function _feeDispersal because _buyBack does not buy any token to pay to referrer

Root Cause

In AmirX.sol, the _feeDispersal could revert unexpectedly, if address(feeToken) = address(0) in _buyBack() and the line below is executed:

https://github.com/sherlock-audit/2024-11-telcoin/blob/main/telcoin-audit/contracts/swap/AmirX.sol#L196

The function _buyBack will not buy anything to pay to referrers because feeToken = address(0).

  1. Not buy anything at
function _buyBack(
        ERC20 feeToken,
        address aggregator,
        address safe,
        bytes memory swapData
    ) internal {
        if (address(feeToken) == address(0)) return;
  1. Failed to pay referrer fee at
function _feeDispersal(DefiSwap memory defi) internal {
       // must buy into TEL
       if (defi.feeToken != TELCOIN)
           _buyBack(
               defi.feeToken,
               defi.aggregator,
               defi.defiSafe,
               defi.swapData
           );

       // distribute reward
       if (defi.referrer != address(0) && defi.referralFee != 0) {
           TELCOIN.forceApprove(address(defi.plugin), 0);
           TELCOIN.safeIncreaseAllowance(
               address(defi.plugin),
               defi.referralFee
           );
           require(
               defi.plugin.increaseClaimableBy(
                   defi.referrer,
                   defi.referralFee
               ),
               "AmirX: balance was not adjusted"
           );
       }
       // retain remainder
       if (TELCOIN.balanceOf(address(this)) > 0)
           TELCOIN.safeTransfer(
               defi.defiSafe,
               TELCOIN.balanceOf(address(this))
           );
   }

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

There are some paths, for example: 1 Call defiSwap() with

  • defi.feeToken = address(0)
  • defi.referrer != address(0) && defi.referralFee != 0

Impact

The transaction reverts unexpectedly

PoC

No response

Mitigation

Please update _verifyDefiSwap() this case