Skip to content
Request an audit

‹ All findings

Attackers can claim deposits to vaults if users specify the router as receiver and don't withdraw shares after

Crit/HighFuji Finance·Three Sigma · Lending aggregator · 6th May, 20233S-FUJI-H07

Description

The BaseRouter checks if the initial balance of the tokens interacted with is the same as the end balance. However, for vaults, it only checks the balance of the underlying asset, not the shares themselves.

Thus, for example, when a user makes a deposit action and specifies the BaseRouter as the receiver, but does not do any further action, the shares will be locked in the BaseRouter. Then, an attacker can call the withdrawal action of the BaseRouter and redeem these shares for any receiver.

Recommendation

Add to the tokensToCheck array the address of the vault itself (its shares).

POC

https://github.com/threesigmaxyz/fuji-issues-external/blob/master/test/POC/POCAttackerStealsUser.t.sol#L40

Status

Addressed here: Fujicracy/fuji-v2#622