search

code-423n4 / 2021-09-sushitrident-2-findings

0 stars 0 forks source link

Incorrect comparison in the `_updatePosition` of `ConcentratedLiquidityPool` #91

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

Handle

broccoli

Vulnerability details

Impact

The _updatePosition function of ConcentratedLiquidityPool uses the < operator to ensure a user's liquidity does not exceed the maximum. However, we should use the <= operator instead.

Proof of Concept

Referenced code: ConcentratedLiquidityPool.sol#L549

Recommended Mitigation Steps

Change < to <= in the referenced line of code.