Description

AnySwap cross-chain transfers will provide the underlying token to the destination only if sufficient liquidity exists on AnySwap reserves. If not, AnySwap will mint a wrapped token (AnyToken) that can be redeemed later when liquidity is available. The FractVaultV1 does not handle that. Even if reserves are checked before executing a swap, since AnySwap is not atomic with no guarantee on order of transactions, simultaneous swaps by other users would lead to locked tokens.

Impact

FractalVaultV1 currently has no way to redeem the AnyTokens to the underlying tokens. However, the recoverERC20 method can be used by the owner to manually recover the anySwap tokens, mitigating this issue's impact.

Recommendations

Add functionality to redeem AnyTokens to their underlying.

Remediation

The issue has been acknowledged by Fractal.