Skip to content
Request an audit

‹ All findings

In BaseRouter, the beneficiary isn't checked when starting a flashloan action and it replaces the previous beneficiary

Crit/HighFuji Finance·Three Sigma · Lending aggregator · 6th May, 20233S-FUJI-C01

Description

When doing a flashloan action in the BaseRouter.sol the beneficiary isn't compared with the beneficiary of the previous action, and the variable gets replaced with the beneficiary for the flashloan, this can lead to a beneficiary change, which could lead to stolen assets.

For example, using 3S-FUJI-M10, it is possible to withdraw for another user, use a flashloan to change the beneficiary to the attacker's address and use the funds withdrawn with 3S-FUJI-M10 however the attacker wishes.

Recommendation

Add a function to check the beneficiary instead of replacing.

POC

https://github.com/threesigmaxyz/fuji-issues-external/blob/master/test/POC/POCAttackerChangesBeneficiary.t.sol#L111

Status

Addressed here: Fujicracy/fuji-v2#615