The pair's token can be stolen without purchasing funds. #424
Labels
2 (Med Risk)
Assets not at direct risk, but function/availability of the protocol could be impacted or leak value
bug
Something isn't working
downgraded by judge
Judge downgraded the risk level of this issue
duplicate-243
satisfactory
satisfies C4 submission criteria; eligible for awards
Lines of code
https://github.com/code-423n4/2022-12-caviar/blob/0212f9dc3b6a418803dbfacda0e340e059b8aae2/src/Pair.sol#L147-L176
https://github.com/code-423n4/2022-12-caviar/blob/0212f9dc3b6a418803dbfacda0e340e059b8aae2/src/Pair.sol#L398-L400
Vulnerability details
Impact
Due to the absence of checking the
inputAmount
value, the pair's funds can be stolen.Proof of Concept
There is no guarantee that the
inputAmount
is greater than zero. In the following situations, a problem occurs when theinputAmount
becomes 0.baseTokenReserves()
is much smaller than the value offractionalTokenReserves()
As many tokens as
outputAmount
exit the pair, but the token does not enter the pair becauseinputAmount
is 0.Recommended Mitigation Steps
In the
buyQuote
function, it is recommended to add code that guarantees that theinputAmount
is greater than zero.The text was updated successfully, but these errors were encountered: