search

code-423n4 / 2021-04-vader-findings

1 stars 0 forks source link

convert collects funds even when minting is disabled #284

Closed code423n4 closed 3 years ago

code423n4 commented 3 years ago

Handle

paulius.eth

Vulnerability details

Impact

function _convert only performs the conversion when minting is turned on: if(minting()){ However, the funds are collected before and it does not reimburse the sender: function convertForMember(address member, uint amount) public returns(uint) { getFunds(VADER, amount); return _convert(member, amount); } Same situation with function redeemForMember. I see no reason why the user should send and lose his tokens when the minting is turned off.

Recommended Mitigation Steps

Probably it would be better to replace "if" with "require" so that users won't be tricked into such an accident.

strictly-scarce commented 3 years ago

https://github.com/code-423n4/2021-04-vader-findings/issues/238

dmvt commented 3 years ago

duplicate of #238