v3-periphery icon indicating copy to clipboard operation
v3-periphery copied to clipboard

PeripheryPayments contract allows any intermediately called contract to reenter and unwrap WETH/sweep tokens

Open moodysalem opened this issue 3 years ago • 0 comments

The PeripheryPayments contract allows any intermediately called untrusted contract (e.g. an ERC777 token gets transferred) to call back into the SwapRouter or NFT contract, taking up to the difference between the current balance of WETH9/WETH10 token and the minimum amount expected by the multicall user

moodysalem avatar Mar 10 '21 18:03 moodysalem