Skip to content
Request an audit

‹ All findings

Attacker may frontrun SyrupRouter::depositWithPermit() call and use a different depositData_ as it is not signed

Low/InfoMaple Syrup Router·by the Three Sigma team·Permissionless lending·21st May 20243S-Sy-L01

Report PageSource

Description

SyrupRouter::depositWithPermit() accepts a permit signature and a depositData_ as extra data to be emitted. An attacker may spot the signature and frontrun the transaction, but with a differerent depositData_, griefing the user.

Recommendation

A simple fix is not possible as the permit function does not accept any extra data. It should be possible to send the transaction through flashbots to mitigate this issue if needed.

Status

Addressed in #cb70312

Found during Three Sigma’s team review · 0xSimao on the review team