search

code-423n4 / 2021-12-defiprotocol-findings

0 stars 0 forks source link

Factory can block auctions #150

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

Handle

0x0x0x

Vulnerability details

When bondPercentDiv is set to 1, it is unlikely that someone can bond by using all tokens (Also because of fees factory would have some tokens). I think this is not intended behaviour.

Mitigation step

Add the condition that this parameter is more than 1 (rather than 0). Another option is to keep it as a lock mechanism, but add a comment about it in factory.

frank-beard commented 2 years ago

We made the decision to keep some of those values open as ideally a dao/multisig will be modifying those parameters if needed. In this case, something like that should be caught in governance or before it is set.