Griefing attack by transferring aTokens to the contract

Originally part of a QA report by Tadashi 69 Griefing attack by transferring aTokens to the contract Summary: tokenToShares uses the following formula for computing the total shares of an user: return supply == 0 ? tokens : tokens.mulsupply.divaToken.balanceOfaddressthis; An attacker wishing to...

Lack of require in redeemToken could produce token loses

Lines of code Vulnerability details Impact Lack of require in redeemToken could produce token loses. Proof of Concept In the method redeemToken the user set the expected redeemAmount, it will compute the expected shares to burn, and after it, it will transfer the amout according the redeemAmount...

redeemToken can fail for certain tokens

Handle cmichel Vulnerability details The SwappableYieldSource.redeemToken function transfers tokens from the contract back to the sender, however, it uses the ERC20.transferFromaddressthis, msg.sender, redeemableBalance function for this. Some deposit token implementations might fail as...

User could lose underlying tokens when redeeming from the IdleYieldSource

Handle shw Vulnerability details Impact The redeemToken function in IdleYieldSource uses redeemedShare instead of redeemAmount as the input parameter when calling redeemIdleToken of the Idle yield source. As a result, users could get fewer underlying tokens than they should. Proof of Concept When...