019.md

Massive Frost Sealion

Medium

Not checking wheather ss.oAmount was 0 or not

Summary

modifier of _verifyStablecoinSwap function verifies wheather ss.oAmount was 0 or not, and revert if ss.oAmount = 0; https://github.com/sherlock-audit/2024-11-telcoin/blob/main/telcoin-audit/contracts/stablecoin/StablecoinHandler.sol#L105 In Amirx::defiToStablecoinSwap function https://github.com/sherlock-audit/2024-11-telcoin/blob/main/telcoin-audit/contracts/swap/AmirX.sol#L119-L127 Initially it was calling _verifyStablecoinSwap(wallet, ss); which will make sure that ss.oAmount !=0,after that we are updating ss.oAmount (ss.oAmount = fBalance - iBalance;) and then we are calling _stablecoinSwap(wallet, ss); so this end up burning notihing from ss.origin instead of reverting transaction

Root Cause

not implementing this check,

if (fBalance - iBalance != 0) ss.oAmount = fBalance - iBalance;
                _stablecoinSwap(wallet, ss);

Internal pre-conditions

1.fBalance - iBalance = 0;

External pre-conditions

non

Attack Path

call Amirx::defiToStablecoinSwap function

Impact

end up burning notihing from ss.origin

PoC

No response

Mitigation

modify code as below,

if (fBalance - iBalance != 0) ss.oAmount = fBalance - iBalance;

or revert the transaction if fBalance - iBalance = 0