Submitted by ktg
https://github.com/code-423n4/2024-03-revert-lend/blob/main/src/automators/Automator.sol#L79-L82
https://github.com/code-423n4/2024-03-revert-lend/blob/main/src/transformers/AutoCompound.sol#L201-L207
Contract AutoCompound inherits Automator contract and it contains a function allowing the owner to disable a vault:
Unlike AutoExit and AutoRange in which disabling Vault has no effect, if vault is disabled in AutoCompound then user cannot withdraw their balances:
As you can see in the first lines, if vaults[owner] = false, then owner must equal msg.sender, this will not be the case if the user has deposited their position to the Vault and hence cannot withdraw their balances.
Below is a POC for the above issue. Save this test case to file test/integration/automators/AutoCompound.t.sol and run it using command:
forge test --match-path test/integration/automators/AutoCompound.t.sol --match-test testTokenStuck -vvvv
In this test case, I simulate the disabling of vault by mockCall the result of nonfungiblePositionManager.ownerOf(tokenId) to address(0x123), since this address is not vault then the condition vaults[owner] is false.
I recommend checking the total user left tokens in variable positionBalances and only allow deactivating the current Vault if the number if zero.
Invalid Validation
kalinbas (Revert) confirmed and commented:
ronnyx2017 (judge) commented:
Revert mitigated:
Status: Mitigation confirmed. Full details in reports from thank_you, b0g0 and ktg.
