045.md

Odd Tartan Gerbil

Medium

Commented-Out Code in migrate_NumaV1V2

Summary

The commented-out code in migrate_NumaV1V2 will cause incomplete functionality, which may lead to migration failures or loss of funds.

Root Cause

In vaultV2Deployer.sol#L78, the migrate_NumaV1V2 function contains commented-out code, which prevents the migration logic from executing as intended.

Internal pre-conditions

1. Admin needs to deploy the contract with the incomplete migrate_NumaV1V2 function.
2. The contract needs to be called with an old vault address for migration.

External pre-conditions

1. An old vault contract must be available for migration to work correctly.

Attack Path

1. An admin calls migrate_NumaV1V2(address _vaultOldAddress).
2. The commented-out code prevents the migration logic from executing.
3. As a result, no action is taken, leading to failure in migrating funds or setting up parameters correctly.

Impact

The migration fails, potentially leaving funds stuck in the old vault or causing an incomplete migration. This can lead to the loss of funds or an incorrect state in the contract.

PoC

Numa/contracts/deployment/vaultV2Deployer.sol

function migrate_NumaV1V2(address _vaultOldAddress) public onlyOwner {
    // Migration code is commented out
    // NumaVaultOld vaultOld = NumaVaultOld(_vaultOldAddress);
    // vaultOld.withdrawToken(lstAddress, lstAddress.balanceOf(_vaultOldAddress), address(vault));
    // vaultManager.setSellFee(vaultOld.sell_fee());
    // vaultManager.setBuyFee(vaultOld.buy_fee());
    // uint numaSupplyOld = vaultOld.getNumaSupply();
    // vaultManager.syncNumaSupply(numaSupplyOld);
    // vault.unpause();
    // emit NumaV1V2MigrationCompleted(msg.sender, _vaultOldAddress);
}

Mitigation

Uncomment and complete the migration logic to ensure it performs the required migration tasks. Alternatively, remove the function if it is no longer needed.