code-423n4 / 2021-09-defiprotocol-findings

1 stars 0 forks source link

Bond div set to zero #241

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

goatbug

Vulnerability details

Impact

bondPercentDiv can be set to zero by the owner. This would give a div by zero error in line 61 bondAmount = basketToken.totalSupply() / factory.bondPercentDiv(); and brick any portfolio balancing ever.

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.

Tools Used

Recommended Mitigation Steps

frank-beard commented 2 years ago

it is assumed the owner is trustworthy in this version of the protocol, however we will add mitigations and further decentralization in future updates

GalloDaSballo commented 2 years ago

Duplicate of #121