PositionActionPendle needs predefined amount which cannot be accurately calculated

[c4-bot-8]

Lines of code

https://github.com/code-423n4/2024-07-loopfi/blob/57871f64bdea450c1f04c9a53dc1a78223719164/src/proxy/PositionActionPendle.sol#L61-L65

Vulnerability details

Impact

Transactions can revert/user's can loose assets when performing PositionActionPendle's _onIncreaseLever

Proof of Concept

PositionActionPendle's _onIncreaseLever function adds liquidity to the Pendle pool. The amount of tokens to be added has to be precomputed before the call itself

    function _onIncreaseLever(
        LeverParams memory leverParams,
        address /*upFrontToken*/,
        uint256 /*upFrontAmount*/,
        uint256 /*swapAmountOut*/
    ) internal override returns (uint256 addCollateralAmount) {
        if (leverParams.auxAction.args.length != 0) {
            _delegateCall(
                address(poolAction), abi.encodeWithSelector(poolAction.join.selector, leverParams.auxAction)
            );

But since the actual amount of tokens that will be available is dependent on the slippage of the swap performed earlier, the calculated amount can be incorrect causing either the transaction to revert or any additional tokens to be lost

    function onFlashLoan(
        address /*initiator*/,
        address /*token*/,
        uint256 amount,
        uint256 fee,
        bytes calldata data
    ) external returns (bytes32) {
        
        ....
        
        bytes memory swapData = _delegateCall(
            address(swapAction),
            abi.encodeWithSelector(swapAction.swap.selector, leverParams.primarySwap)
        );
        uint256 swapAmountOut = abi.decode(swapData, (uint256));


        // deposit collateral and handle any CDP specific actions
        uint256 collateral = _onIncreaseLever(leverParams, upFrontToken, upFrontAmount, swapAmountOut);

Tools Used

Manual review

Recommended Mitigation Steps

Use the actual obtained amount similar to the one implemented for balancer's join

Assessed type

Other

[c4-judge]

koolexcrypto marked the issue as duplicate of #87

[c4-judge]

koolexcrypto marked the issue as satisfactory