PoolAction.sol#_balancerJoin does not support native ETH as input token.

[c4-bot-3]

Lines of code

https://github.com/code-423n4/2024-07-loopfi/blob/main/src/proxy/PoolAction.sol#L142-L152

Vulnerability details

Impact

PoolAction.sol#_balancerJoin does not support native ETH as input token.

Bug Description

PoolAction is used to join a Balancer or Pendle pool. Both Balancer and Pendle accepts native ETH as input token.

We can check that the PoolAction contract also supports passing native ETH as input token, because 1) join() function, which serves as the entry function, is payable; 2) _pendleJoin() passes msg.value along when calling pendleRouter.addLiquiditySingleToken().

However, the issue is that when joining balancer pool, the msg.value is not passed along.

    function join(PoolActionParams memory poolActionParams) public payable {
        if (poolActionParams.protocol == Protocol.BALANCER) {
            _balancerJoin(poolActionParams);
        } else if(poolActionParams.protocol == Protocol.PENDLE) {
            _pendleJoin(poolActionParams);
        } else {
            revert PoolAction__join_unsupportedProtocol();
        }
    }

     function _balancerJoin(PoolActionParams memory poolActionParams) internal {
        (bytes32 poolId, address[] memory assets, uint256[] memory assetsIn, uint256[] memory maxAmountsIn) = abi
            .decode(poolActionParams.args, (bytes32, address[], uint256[], uint256[]));

        for (uint256 i = 0; i < assets.length; ) {
            if (maxAmountsIn[i] != 0) {
                IERC20(assets[i]).forceApprove(address(balancerVault), maxAmountsIn[i]);
            }

            unchecked {
                ++i;
            }
        }

        // @auditnote: BUG, msg.value is not passed.
>       balancerVault.joinPool(
            poolId,
            address(this),
            poolActionParams.recipient,
            JoinPoolRequest({
                assets: assets,
                maxAmountsIn: maxAmountsIn,
                userData: abi.encode(JoinKind.EXACT_TOKENS_IN_FOR_BPT_OUT, assetsIn, poolActionParams.minOut),
                fromInternalBalance: false
            })
        );
    }

    function _pendleJoin(PoolActionParams memory poolActionParams) internal {
        (
            address market,
            ApproxParams memory guessPtReceivedFromSy,
            TokenInput memory input,
            LimitOrderData memory limit
        ) = abi.decode(poolActionParams.args, (address, ApproxParams, TokenInput , LimitOrderData));
        
        
        if (input.tokenIn != address(0)) {
                IERC20(input.tokenIn ).forceApprove(address(pendleRouter),input.netTokenIn);
            }

        pendleRouter.addLiquiditySingleToken{value: msg.value}(poolActionParams.recipient, market, poolActionParams.minOut, guessPtReceivedFromSy, input, limit);
    }

Proof of Concept

N/A

Tools Used

Manual Review

Recommended Mitigation Steps

-       balancerVault.joinPool(
+       balancerVault.joinPool{value: msg.value}(

Assessed type

Other

[c4-judge]

koolexcrypto changed the severity to QA (Quality Assurance)

[c4-judge]

This previously downgraded issue has been upgraded by koolexcrypto

[c4-judge]

koolexcrypto marked the issue as duplicate of #70

[c4-judge]

koolexcrypto marked the issue as satisfactory