search

code-423n4 / 2021-09-defiprotocol-findings

1 stars 0 forks source link

handleFees() will revert if licenseFee is too high #52

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

gpersoon

Vulnerability details

Impact

The function handleFees() will revert if feePct >BASE ==> feePct = timeDiff licenseFee / ONE_YEAR; ==> BASE < timeDiff licenseFee / ONE_YEAR; ==> licenseFee > BASE * ONE_YEAR / timeDiff So licenseFee should have a maximum value to prevent this. Probably there is also a reasonable upperlimit to licenseFee the let the protocol function properly.

Proof of Concept

https://github.com/code-423n4/2021-09-defiProtocol/blob/main/contracts/contracts/Basket.sol#L110 function handleFees() private { .. uint256 timeDiff = (block.timestamp - lastFee); uint256 feePct = timeDiff licenseFee / ONE_YEAR; uint256 fee = startSupply feePct / (BASE - feePct); // will revert if feePct > BASE

Tools Used

Recommended Mitigation Steps

Define an upperlimit for licenseFee Enforce this in the function proposeBasketLicense() of Factory.sol

GalloDaSballo commented 2 years ago

Agree with finding, mitigation is to add a limit to licenseFee