Skip to content
Request an audit

‹ All findings

Stuck ETH in Curve exchanges due to sending msg.value to the exchange instead of amountIn

Crit/HighSingularity·Three Sigma · Private DeFi access · 26th February, 20243S-SG-C06

ReportSource

Description

The curve exchanges allow users who deposited to use their note commitments to swap for other assets. Thus, they have already deposited the ETH, but the exchanges still require the amountIn to be msg.value, leading to stuck ETH.

POC here.

Recommendation

Replace IExchange(exchangeContract).exchange{value: msg.value} by IExchange(exchangeContract).exchange{value: amountIn}.

Status

Addressed in #8b300f0.