search

code-423n4 / 2021-12-amun-findings

0 stars 0 forks source link

`totalSupply` may go above `this.getCap()` #242

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

gzeon

Vulnerability details

Impact

Pool cap is checked in L154 https://github.com/code-423n4/2021-12-amun/blob/98f6e2ff91f5fcebc0489f5871183566feaec307/contracts/basket/contracts/facets/Basket/BasketFacet.sol#L154

        require(
            totalSupply.add(_amount) <= this.getCap(),
            "MAX_POOL_CAP_REACHED"
        );

but since we mint _amount to the user and some % of feeAmount to Beneficiary, totalSupply can actually go above the defined cap.

Recommended Mitigation Steps

        require(
            totalSupply.add(_amount).add(feeAmount.mul(bs.entryFeeBeneficiaryShare).div(10**18)) <= this.getCap(),
            "MAX_POOL_CAP_REACHED"
        );
loki-sama commented 2 years ago

Duplicate #283