Skip to content

Latest commit

 

History

History
48 lines (30 loc) · 2.36 KB

M-03.md

File metadata and controls

48 lines (30 loc) · 2.36 KB

Delegate uses incorrect parameter for the token amount

The delegate implementation uses the incorrect "amount" parameter from the JBDidPayData struct that is sent to the didPay() function.

Impact

The implementation of the pay() function in the terminal builds the JBDidPayData struct that is used as an argument to the didPay() function of the different delegate allocations. This struct contains two different amount members:

https://github.com/jbx-protocol/juice-contracts-v3/blob/main/contracts/structs/JBDidPayData.sol#L10-L11

@member amount The amount of the payment. Includes the token being paid, the value, the number of decimals included, and the currency of the amount.
@member forwardedAmount The amount of the payment that is being sent to the delegate. Includes the token being paid, the value, the number of decimals included, and the currency of the amount.

The amount field is the total "global" amount of the payment, while the forwardedAmount field is the one assigned to each delegate allocation. The amount member is filled here:

https://github.com/jbx-protocol/juice-contracts-v3/blob/main/contracts/abstract/JBPayoutRedemptionPaymentTerminal3_1.sol#L1467

JBTokenAmount memory _bundledAmount = JBTokenAmount(token, _amount, decimals, currency);

While the forwardedAmount is assigned in each iteration of the different elements of the _delegateAllocations list, with the proper amount for each call to didPay():

https://github.com/jbx-protocol/juice-contracts-v3/blob/main/contracts/abstract/JBPayoutRedemptionPaymentTerminal3_1.sol#L1526-L1532

// If this terminal's token is ETH, send it in msg.value.
if (token == JBTokens.ETH) _payableValue = _delegateAllocation.amount;

// Pass the correct token forwardedAmount to the delegate
_data.forwardedAmount.value = _delegateAllocation.amount;

_delegateAllocation.delegate.didPay{value: _payableValue}(_data);

This means that the implementation should use the amount from the forwardedAmount member and not the amount member.

https://github.com/code-423n4/2023-05-juicebox/blob/main/juice-buyback/contracts/JBXBuybackDelegate.sol#L266

...
amountSpecified: int256(_data.amount.value),
...

Recommendation

The implementation of the didPay() function in the delegate should use _data.forwardedAmount.value instead of _data.amount.value.