The input parameter _amount is not checked for 0 in functions deposit or withdraw.
While both functions will eventually revert not before calling updatePool and executing quite a bit of code using a parameter that does not make sense.
Depositing or withdrawing 0 tokens does not seem to be a necessary use case to support.
Handle
ye0lde
Vulnerability details
Impact
The input parameter
_amount
is not checked for 0 in functionsdeposit
orwithdraw
.While both functions will eventually revert not before calling
updatePool
and executing quite a bit of code using a parameter that does not make sense.Depositing or withdrawing 0 tokens does not seem to be a necessary use case to support.
Proof of Concept
In the case of
withdraw
here: https://github.com/code-423n4/2022-01-trader-joe/blob/a1579f6453bc4bf9fb0db9c627beaa41135438ed/contracts/RocketJoeStaking.sol#L116-L135This line at 117 allows any user to proceed providing valid user information even though the values are zero:
And the require at 118 basically checks that 0 >= 0:
The
deposit
function is similar: https://github.com/code-423n4/2022-01-trader-joe/blob/a1579f6453bc4bf9fb0db9c627beaa41135438ed/contracts/RocketJoeStaking.sol#L96-L112Tools Used
Visual Studio Code, Remix
Recommended Mitigation Steps
I would recommend adding:
at the start of each function.