SwapAction.sol#transferAndSwap is still payable though direct ETH is not supported anymore.

[c4-bot-8]

Lines of code

https://github.com/code-423n4/2024-10-loopfi/blob/main/src/proxy/SwapAction.sol#L102

Vulnerability details

Impact

SwapAction.sol#transferAndSwap supports native ETH transfer, but all native ETH swaps (balancer, pendle) are removed.

Bug Description

Note: This is based on the 2024-07 Loopfi contest code-423n4/2024-07-loopfi-findings#70 issue. This protocol team applied a fix, but the fix is incomplete.

The original fix was applied that all native ETH support is removed, and all payable modifiers for external functions are removed. However, SwapAction.sol#transferAndSwap was left out, and it is still marked payable.

    function transferAndSwap(
        address from,
        PermitParams calldata permitParams,
        SwapParams calldata swapParams
@>  ) external payable returns (uint256) {
        if (from != address(this)) {
            uint256 amount = swapParams.swapType == SwapType.EXACT_IN ? swapParams.amount : swapParams.limit;
            _transferFrom(swapParams.assetIn, from, address(this), amount, permitParams);
        }
        return swap(swapParams);
    }

Proof of Concept

N/A

Tools Used

Manual Review

Recommended Mitigation Steps

Remove the payable modifier.

Assessed type

Payable

[c4-judge]

koolexcrypto changed the severity to QA (Quality Assurance)

[c4-judge]

koolexcrypto marked the issue as grade-b