search

code-423n4 / 2021-09-defiprotocol-findings

1 stars 0 forks source link

`mintTo` arguments order #257

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

0xsanson

Vulnerability details

Impact

In Basket.sol, there is a function mintTo(uint256 amount, address to). It's best practice to use as first argument to, and as second amount; see also the order used in L84 (_mint(to, amount)) and L86 (Minted(to, amount)).

Proof of Concept

https://github.com/code-423n4/2021-09-defiProtocol/blob/main/contracts/contracts/Basket.sol#L76

Tools Used

editor

Recommended Mitigation Steps

Consider switching the arguments (also don't forget to change the calls to the function).

GalloDaSballo commented 2 years ago

It's really minor, but I agree, address, amount is the standard This is a convention from transfer(address, amount), really minor but is a convention