M-11·

`liquidityFacet`: unauthorized liquidity removal for other users

Not reportedoptionsleverageblack-scholes

TL;DR

The removeLiquidity() function currently allows any user to call the function and remove liquidity on behalf of another user, as it does not properly restrict access to the user performing the action.

Severity

MEDIUM

Method

MManual review

CAT.

02Section · Severity

Severity

Impact: Low

Likelihood: High

03Section · Description

Description

The removeLiquidity() function currently allows any user to call the function and remove liquidity on behalf of another user, as it does not properly restrict access to the user performing the action. This could lead to unauthorized removal of liquidity from another user's account, potentially resulting in loss of assets, especially in scenarios where malicious actors attempt to exploit the function.

solidity

    function removeLiquidity(address _tokenOut, uint256 _lpAmount, uint256 _minOut, address _to)
        external
        override
        nonReentrant
        whenNotPaused
    {
        _requireAmount(_lpAmount);
        _validateAsset(_tokenOut);

        if (_lpAmount > _getUserUnlockedLP(_to)) revert PoolErrors.LiquidityLocked();

        // remove liquidity
        (, uint256 netOutAmount, uint256 pFee, uint256 tokenOutPrice) = _calcRemoveLiquidity(_tokenOut, _lpAmount);
        _removeLiquidityFromPool(_minOut, netOutAmount, _tokenOut, tokenOutPrice, pFee);

        uint256 rewardsTokenOut = _isFullyExiting(_to, _lpAmount) ? _claimAllRewards(_to, _tokenOut) : 0;

        // PLP management
        _updateLockData(false, _lpAmount, _to);
        _exitAndBurnPLP(_lpAmount, _to);

        _doTransferOut(_tokenOut, _to, netOutAmount + rewardsTokenOut);
        _emitPLPPrice();
        emit LiquidityRemoved(_to, _tokenOut, _lpAmount, netOutAmount, rewardsTokenOut, pFee);
    }

04Section · Recommendations

Recommendations

Implement access control to ensure that only the user who owns the liquidity can remove their liquidity. This can be done by checking if the _to address is the same as the caller (msg.sender) before proceeding with the liquidity removal.

05Section · Report provenance

Report provenance

Published by Pashov Audit Group, with Carlos (Bloqarl) participating as a contractor. The source report states that its fixes review was not fully completed; no final remediation disposition is recorded for this finding. Read the full report.