Lines of code

Vulnerability details

Impact

If transfer of any reward token returns False or reverts for whatever reason, users who deposited will not be able to withdraw their deposit. A malicious pool creator could abuse this to lock tokens from victims by using two reward tokens, one normal/valuable token that transfers normally, and one “evil” token that will revert whenever its transfer function is called during a withdraw

Proof of Concept

1. Attacker creates an ERC20 token that has a backdoor they can toggle that will cause all transfers to revert.
2. Attacker creates a pool and adds to it a reward token such as WETH (to attract victims/users) and their malicious token created in step 1.
3. Victim/user deposits depositToken into evil pool.
4. Attacker toggles switch on evil token so now all transfers fail.
5. Victim/user tries to withdraw their depositToken from evil pool. The transfer of the the depositToken and WETH would succeed but because the transfer of the evil token reverts, the entire call to withdraw reverts and the victim gets back nothing.

Recommended Mitigation Steps

Add an emergency withdraw function that allows withdrawing one’s deposit without receiving any reward token.

In addition, one might want to consider adding a function allowing users to receive each reward token separately.

The text was updated successfully, but these errors were encountered:

All reactions