Re-entrancy bug in MarginRouter.crossSwapTokensForExactTokens allows inflating balance

Email address [email protected] Handle @cmichelio Eth address 0x6823636c2462cfdcD8d33fE53fBCD0EdbE2752ad Vulnerability details One can call the MarginRouter.crossSwapExactTokensForTokens function first with a fake contract disguised as a token pair: crossSwapExactTokensForTokens0.0001 WETH, 0,...

Missing fromToken != toToken check in MarginRouter.crossSwapExactTokensForTokens/MarginRouter.crossSwapTokensForExactTokens

Email address [email protected] Handle @cmichelio Eth address 0x6823636c2462cfdcD8d33fE53fBCD0EdbE2752ad Vulnerability details Attacker calls MarginRouter.crossSwapExactTokensForTokens with a fake pair and the same token0 == tokne1. crossSwapExactTokensForTokens1000 WETH, 0, ATTACKERCONTRACT, WETH,...