Submitted by carrotsmuggler, also found by QiuhaoLi and J4X
https://github.com/code-423n4/2024-02-hydradx/blob/603187123a20e0cb8a7ea85c6a6d718429caad8d/HydraDX-node/pallets/stableswap/src/lib.rs#L638
https://github.com/code-423n4/2024-02-hydradx/blob/603187123a20e0cb8a7ea85c6a6d718429caad8d/HydraDX-node/pallets/stableswap/src/lib.rs#L551
The contracts for stableswap has 2 functions dealing with removal of liquidity: remove_liquidity_one_asset and withdraw_asset_amount. However, both these functions allow redeeming LP tokens and payout in only one token. Critically, this contract is missing Curve protocols remove_liquidity function, which allows redeeming LP tokens for all the different tokens in the pool.
The result of this decision is that when the complete liquidity of a pool is to be removed, the contract reverts with an arithmetic overflow. In curve protocol, when removing the complete liquidity, the composing tokens are removed from the pool. However, they also need to be converted to a single token, using a liquidity that wont exist anymore. This leads to an issue somewhere in the mathematics of the curve liquidity calculation, and thus reverts.
A simple POC to remove the complete liquidity is coded up below. This POC reverts when the entire amount of shares is being redeemed.
Here ALICE adds liquidity, and is trying to redeem all her LP tokens. This reverts with the following:
This is because the internal math of the stableswap algorithm fails when there is no more liquidity.
Substrate
Allow multi-token liquidity withdrawal, which would allow complete redeeming of all LP tokens.
Under/Overflow
enthusiastmartin (HydraDX) disputed and commented:
Lambda (judge) commented:
