# Malicious path can be passed to redeem/withdraw() allowing an attacker to draing the strategy Crit/High · Three Sigma · Lending · 2nd December 2024 Finding 3S-MORE-C02 of the MORE Optimizer security review. - Protocol: https://www.more.markets/ - Report: /reports/more-optimizer - Source: https://github.com/0xsimao/audits/blob/main/Three%20Sigma/2024-12-02-more-markets.pdf --- ### Description path is not validated in redeem/withdraw(), which could lead to problems as the flow should always sell and buy the same token. Note: if a reentrant token is passed in the path it may be possible to deposit in the LoopStrategy while swapping, which would lead to stolen funds as the ratio would be higher due to having burned the shares but the assets are still in the strategy. Note2: if ankrFlow is reentrant it could also be used to drain the funds. For example, consider this path: ```solidity - attacker creates a pool of wFlow/reentrantToken and ankrFlow/reentrantToken; - attacker deposits large amount of funds in the LoopStrategy; ``` - attacker withdraws using the following path: - ankrFlow -> reentrantToken - reentrantToken -> wFlow; - whilst swapping, the reentrantToken allows the attacker to reenter the strategy and deposit. This deposit will give inflated shares as the _withdraw() method burns the shares first, but only withdraws all the assets by the end (the vault, for example); - the attacker withdraws the inflated shares for much more funds. ### Recommendation Do not allow arbitrary paths. ### Status Addressed in [#ef31c48](https://github.com/MoreLabsXYZ/MORE-Optimizers/commit/ef31c48df3b55616a6162a68b8f1cfe6540d3de3), [#d9a89a9](https://github.com/MoreLabsXYZ/MORE-Optimizers/commit/d9a89a9b51da83cc9fe5309ee925669974f68bc2). Disclosed by 0xSimao (https://0xsimao.com/). --- Related findings: - [Distribute is permissionless, allowing malicious users to specify 0 slippage and sandwich the swap](https://0xsimao.com/findings/trestle-permissionless-specify-slippage-sandwich): Trestle wTIA Bridge - [BasicVault::_redeem() burns newAmount but redeems amount, allowing attackers to drain the vault](https://0xsimao.com/findings/mitosis-redeem-burns-redeems-drain): Mitosis - [Attacker can block LayerZero channel due to missing check of minimum gas passed](https://0xsimao.com/findings/tapioca-dao-layer-zero-channel-gas): Tapioca DAO - [Withdraw snapshot logic can be tricked allowing users to withdraw right away](https://0xsimao.com/findings/glacier-withdraw-snapshot-tricked-away): Glacier