provideReinvest Can Be Manipulated Via A Sandwich Attacking To Extract More Malt Tokens From msg.sender

[code423n4]

Handle

leastwood

Vulnerability details

Impact

getOptimalLiquidity is called from within provideReinvest to calculate how much Malt is required from the user. Subsequently, the contract transfers the correct amount of Malt tokens from msg.sender. As the caller of this function is unable to predetermine how much they should approve the contract as a spender, it is likely that users approve an unlimited amount. As a result, a well-funded attacker could alter the result of getOptimalLiquidity by impacting its underlying reserves, causing the contract to transfer more Malt tokens than the user expected. This could generate poor UX issues for users.

Proof of Concept

https://github.com/code-423n4/2021-11-malt/blob/main/src/contracts/RewardReinvestor.sol#L68-L71
https://github.com/code-423n4/2021-11-malt/blob/main/src/contracts/DexHandlers/UniswapHandler.sol#L111-L126

Tools Used

Manual code review

Recommended Mitigation Steps

provideReinvest should accept a maxMaltLiquidity parameter which should allow the user to limit the amount of tokens the spender (i.e. the RewardReinvestor contract) is able to receive.

[0xScotch]

#219

[GalloDaSballo]

Duplicate of #219