Closed code423n4 closed 3 years ago
cmichel
Docs about PoolStorage.activateCooldownFee say:
PoolStorage.activateCooldownFee
// Variable used to calculate the fee when activating the cooldown // Max value is uint32(-1) which creates a 100% fee on the withdrawal
But PoolBase.setCooldownFee does not have a max value check of uint32(-1). It should be added to reduce trust in governance.
PoolBase.setCooldownFee
uint32(-1)
It is stored in a uint32 so the maximum value can be uint32(-1), right?
uint32
duplicate of #28 so invalid
Handle
cmichel
Vulnerability details
Docs about
PoolStorage.activateCooldownFee
say:But
PoolBase.setCooldownFee
does not have a max value check ofuint32(-1)
. It should be added to reduce trust in governance.