Tokens can be sent directly

[code423n4]

Handle

pauliax

Vulnerability details

Impact

Token join contracts check that the final outputAmount is equal to _joinTokenStruct.outputAmount:

  uint256 outputAmount = outputToken.balanceOf(address(this));
  require(
      outputAmount == _joinTokenStruct.outputAmount,
      "FAILED_OUTPUT_AMOUNT"
  );

While these contracts are only for convenience, a theoretical attack exists here: a malicious actor can monitor the mempool and send the smallest fraction of the output token (basket) directly to the contract thus breaking this check.

Recommended Mitigation Steps

Consider replacing == with >= .

[loki-sama]

duplicate #81