Lines of code
<https://github.com/pooltogether/v4-twab-delegator/blob/master/contracts/PermitAndMulticall.sol#L31&gt;

Vulnerability details

Impact

In TWABDelegator.sol anyone can call the multicall() function which then calls _multicall() in PermitAndMulticall.sol. When using batched delegatecalls the msg.sender and msg.value are not updated on every iteration and this can result in double spending bugs as the linked article demonstrates.

#Proof of Concept

<https://github.com/pooltogether/v4-twab-delegator/blob/master/contracts/PermitAndMulticall.sol#L31&gt;

<https://samczsun.com/two-rights-might-make-a-wrong/&gt;

Tools Used

Manual code review

Recommended Mitigation Steps

Consider removing the ability to do batched delegatecalls or add logic on every loop to ensure the msg.value is updated or accordingly.

The text was updated successfully, but these errors were encountered:

All reactions