sechub
HomeServicesAssetsJobsFindingsTicketsGovCheck
Guest Mode. Click here to sign in and access all features

    Users cannot `withdraw` or `deposit` if `pendingAmount == 0` for tokens that disallow 0 value transfer

    Holoride: DeFi Token

    Severity
    Medium
    Status
    Fixed
    Location(s)

    https://github.com/sub7security/holoride-defi/blob/0557444ec0b3a4df44e0cf6c9bcd8e06eaea63c4/contracts/Farming.sol#L247

    https://github.com/sub7security/holoride-defi/blob/0557444ec0b3a4df44e0cf6c9bcd8e06eaea63c4/contracts/Farming.sol#L269

    Description

    Some tokens such as the old aave token LEND will revert when a value of 0 is transferred. If such tokens are used, it can prevent withdraw or deposit in some cases. This will happen on the condition that

    > uint256 pendingAmount = user.amount.mul(pool.accERC20PerShare).div(1e36).sub(user.rewardDebt) = 0.

    In what cases will this happen?

    This happens only when user.amount.mul(pool.accERC20PerShare).div(1e36).sub(user.rewardDebt) == 0, i.e. user.amount.mul(pool.accERC20PerShare).div(1e36) == user.rewardDebt. There are 2 cases where this will occur. Specifically, it happens when no rewards are accrued yet as we are on the same block or actions are made before startBlock.

    1. Some combination of depositing and withdrawing in the same block. For eg, depositing twice in the same block, or depositing and withdrawing in the same block, or withdrawing twice a different amount in the same block.
    2. Deposit happens when block.number == endBlock. Note that this is possible as deposit checks require(block.number <= endBlock, "deposit: cannot deposit after end block");. In this case, the normal withdraw will not be possible since no rewards are accured.
    3. A combination of any of the above is done before startBlock, for eg, a user deposits some amount, and wants to make another deposit will not be able to do so since reward accuring has not started.

    Fortunately, user's LP stake position will not be lost as they can emergencyWithdraw. However, since we believe this issue is not intended and it is a form of DOS for some tokens, we put it at medium severity.

    Recommendation

    Consider making the ERC20 transfer only if pendingAmount > 0 in both deposit and withdraw.

    Comments
    No comments yet

    Users cannot `withdraw` or `deposit` if `pendingAmount == 0` for tokens that disallow 0 value transfer

    Holoride: DeFi Token

    Severity
    Medium
    Status
    Fixed