Skip to content
Request an audit

‹ All findings

In BaseRouter, _handleSwapAction(...), users shouldn't be allowed to send funds to an allowed flasher

Low/InfoFuji Finance·Three Sigma · Lending aggregator · 6th May, 20233S-FUJI-L03

Description

_handleSwapAction(...) allows sending funds to the Flasher. This should be to pay for a taken flashloan. However, if the goal of this exception is only to enable the payment of a flashloan, it should be removed and handled differently.

This is because it may allow users to send funds to the flasher, without taking a flashloan, either maliciously or by mistake.

Recommendation

Create a new action called repayFlashLoan and use it to repay the flashLoan. This action should revert if the amount being repaid is bigger than the flashloan taken.

Status

Acknowledged with the following statement: The issue identified is acknowledged by the Fuji team, however, as indicated the severity of this issue is low. During Q3-2023 we will be working on general optimizations/improvements on the router contracts.