Submitted by WatchPug
https://github.com/Plex-Engineer/zeroswap/blob/03507a80322112f4f3c723fc68bed0f138702836/contracts/Migrator.sol#L28-L46
When minting LP tokens (addLiquidity), the amount of lp tokens you are getting is calculated based on liquidity = Math.min(amount0.mul(_totalSupply) / _reserve0, amount1.mul(_totalSupply) / _reserve1);, if the _totalSupply is small enough, and 1 wei of the lp token worth large amounts of token0 and token1, the user who adds small amounts of liquidity will receive less amount of lp tokens due to precision loss.
A sophisticated attacker can artificially create that scenario by mint only 1 wei of lp token and add 1e24 or even larger amounts of token0 and token1 by sending the tokens to the contract and then call sync() to update the reserves.
Then all the new depositors will lose up to 1e24, lets say they deposited 1.99e24, they will only receive 1 wei of lp token, therefore, losing 0.99e24 of token0 and token1.
This attack vector was mitigated the original version of UniswapV2Pair by introcuing the MINIMUM_LIQUIDITY minted and permanently lock in address(0) upon the first mint.
However, this can now be bypassed with the migrator, and this attacker vector is open again.
Given the fact that zeroswap will be a DEX that does not need a feature to migrate liquidity from other DEXs, consider removing the migrator.
tkkwon1998 (Canto) acknowledged and commented:
Alex the Entreprenerd (judge) decreased severity to Medium and commented:
