0xekez/cw-flash-loan

A CosmWasm contract for native and cw20 flash loans.

cw-flash-loan's Issues

confirm this isn't vulnerable to provider reentrancy

browsing through the white whale flash loan contracts, i stumbled upon this commit: White-Whale-Defi-Platform/white-whale-core@36ccf9f. tl;dr: they disable depositing funds into the vault while flash loans are outstanding as they believe this could lead to a reentrancy attack.

the testing for this contract is too limited atm to test this, and i'm not in the mood. so instead, i'm making this issue to tell you, dear reader, do not use this contract unless you make sure it is not vulnerable to this.

that said, i do not think we are vulnerable to this. from a theory perspective, our provider math is constructed so as to guarantee:

if you put in tokens, you will get the same number of tokens out unless the contract balance increases while you have your tokens in.

the entire reason it exists is to determine that. if you flash loan, and provide those tokens, you're paying the flashloan amount for a percentage ownership of the balance after you provide equal to the flahloan amount. were this not the case, it would be possible to provide an amount of tokens, and instantly get more out.

an example

say the world exists like:

balance = 10
total_provided = 10

i take out a flash loan for 5, and provide them.

amount_to_provide  = total_provied * provided / balance = 10 * 5 / 5 = 10

i then withdraw with the world existing like:

balance = 10
total_provided = 20

to compute my entitlement:

compute_entitled(provided, total_provided, balance)
= compute_entitled(10, 20, 10)
= 10 * 10 / 20
= 10/2
= 5

so i've flash loaned out five tokens, provided them, and then withdrawn them, without making any money.