# Attackers can include other users nullifiers to make their funds stuck when adding liquidity to curve Crit/High · Three Sigma · Private DeFi access · 26th February, 2024 Finding 3S-SG-H07 of the Singularity security review. - Protocol: https://www.thesingularity.network/ - Report: /reports/singularity - Source: https://cdn.sanity.io/files/qoqld077/production/45b8aac56a2b8e3b557df4329ac9bf8220b64012.pdf --- ### Description [CurveLiquidityAssetManager::curveAddLiquidity()](https://github.com/portalgateme/darkpool-v1-zk-contracts-fork/blob/master/contracts/defi/curve/CurveAddLiquidityAssetManager.sol#L112) always spends the nullifiers, even if the amounts used are 0. In the [circuit](https://github.com/portalgateme/darkpool-v1-zk-contracts-fork/blob/master/circuits/curve_add_liquidity/src/main.nr#L40), if the amount is 0, it does not validate the nullifier against the user signature, making it possible to include nullifiers from other users in the same transaction and losing their funds forever. [Here](https://github.com/portalgateme/darkpool-v1-zk-contracts-fork/blob/fuzzing/test/foundry/CurveLiquidityAssetManager.t.sol#L221) is the poc. ### Recommendation In CurveAddLiquidityAssetManager::_addLiquidity() skip [_postWithdraw()](https://github.com/portalgateme/darkpool-v1-zk-contracts-fork/blob/master/contracts/defi/curve/CurveAddLiquidityAssetManager.sol#L435-L437) if the amount is 0. ### Status Addressed in [#8b300f0](https://github.com/portalgateme/darkpool-v1-zk-contracts-fork/commit/8b300f07a28f2c073154c8de3e9e90ba64ef1934). --- Related findings: - [Bad check in `Vesting.sol::_resetVestingPlans` will prevent users from adding additional liquidity in `SymmVesting.sol`](https://0xsimao.com/findings/symmio-staking-and-vesting-vesting-plans-additional-symm): Symmio, Staking and Vesting - [Add a 0 address check on the pool when adding liquidity for greater verbosity](https://0xsimao.com/findings/nftperp-ii-add-adding-greater-verbosity): Nftperp Matching Engine - [Attackers will reset `avgStart` of any user making rewards stuck for longer and get lost to savings](https://0xsimao.com/findings/exactly-protocol-update-staking-contract-ii-avg-rewards-stuck-longer): Exactly Protocol Update - Staking Contract - [Attackers can claim deposits to vaults if users specify the router as receiver and don't withdraw shares after](https://0xsimao.com/findings/fuji-finance-deposits-specify-withdraw-shares): Fuji Finance