Submitted by 0xAlix2, also found by 0xRajkumar, Abdessamed, carrotsmuggler, Egis_Security, and Tigerfrake
/contracts/pool-manager/src/liquidity/commands.rs#L282-L286
When users provide liquidity into different pools, they call the provide_liquidity function, they are also allowed to pass unlocking_duration, if provided, the minted LP shares are locked in the farm manager for extra rewards, see here.
The protocol doesnt allow users to open positions in the farm manager on behalf of other users, from the docs:
It gets validated using the following:
On the other hand, when providing single-sided liquidity, half of the deposited amount is swapped to the other asset and then deposited, the process is as follows: provide_liquidity -> swap -> rely -> provide_liquidity.
However, the issue here is that the second provide_liquidity gets called from the contract itself, i.e., info.sender is the contract address itself, which forces the above receiver validation to revert wrongly.
This blocks users from depositing single-sided liquidity and locks the LP tokens in the farm manager in a single action, breaking a core functionality.
Add the following test in contracts/pool-manager/src/tests/integration_tests.rs#locking_lp:
Modify the receiver validation in the if let Some(unlocking_duration) = unlocking_duration block, to bypass the condition if the sender is the contract itself.
To ensure that this doesnt cause any flaws, a receiver validation should be added to the if is_single_asset_provision block, to ensure that the sent receiver is valid, is it enough to do the following:
jvr0x (MANTRA) confirmed
