search

code-423n4 / 2021-07-spartan-findings

0 stars 0 forks source link

BondVault fails if no SPARTA in DAO #175

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

cmichel

Vulnerability details

The DAO.bond function requires BASE tokens in the DAO contract. It's unclear how these tokens get there. If there are not enough tokens, the transaction will revert.

Recommended Mitigation Steps

Keep a balance of BASE in the DAO contract.

verifyfirst commented 3 years ago

Dao has to vote for a sparta allocation before anyone can participate in bonding

SamusElderg commented 3 years ago

Bond is temporary & limited by design; the DApp handles the required conditional checks to only allow bonding when the user is attempting a txn that is within the available allocations held in the DAO (after the DAO proposes and successfully confirms a BOND allocation)

This will only be an issue for the end-user if they are interacting directly with the contracts (which is definitely not intended with these Sparta-specific features; users should expect risk if they are doing so) or in very edge cases where the SPARTA allocation is almost all drained and a user inputs a bond amount within the 5-10 second DApp refresh-window and are slow to confirm the txn

So for me it is a non-issue and instead a very small UX-issue when the allocation is almost/drained

ghoul-sol commented 3 years ago

Per sponsor comment, non-critical