code-423n4 / 2021-09-yaxis-findings

0 stars 0 forks source link

totalDepositCap caps shares not amount #83

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

pauliax

Vulnerability details

Impact

"totalDepositCap is the maximum amount of value that can be deposited", however, it is compared against totalSupply() which is the number of shares and may be different than the deposited amount.

Recommended Mitigation Steps

Either track the amounts and check against the sum of them or remove the confusion by naming this variable something like totalSharesCap and updating comments.

Haz077 commented 2 years ago

totalSupply() can't be different than deposited amount as it increase/decrease with deposit/withdraw.

GalloDaSballo commented 2 years ago

Duplicate of #25