KryptoniteDAO / krp-cdp-contracts

Kryptonite stable coin kUSD relevant contracts
0 stars 0 forks source link

Unchecked redeem fee #14

Closed smithmonnnnnnn closed 1 year ago

smithmonnnnnnn commented 1 year ago

Description: The instantiate and update_config functions from central_control contract do not verify that redeem_fee is lower than 1. If it is mistakenly set to a value greater than 1, the operation of redeeming stable coins will always panic because of an underflow error. Code Location: krp-cdp-contracts/contracts/central_control/src/contract.rs#L58, L502-504