search

code-423n4 / 2022-04-badger-citadel-findings

0 stars 1 forks source link

no sanity checks on minDiscount #185

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

Lines of code

https://github.com/code-423n4/2022-04-badger-citadel/blob/main/src/Funding.sol#L356

Vulnerability details

Unlike maxDiscount, minDiscount is missing some sanity checks: minDiscount should be smaller than MAX_BPS minDoscount should be smaller than maxDiscount

GalloDaSballo commented 2 years ago

Have to agree that a check is missing here

jack-the-pug commented 2 years ago

Downgrading to QA as even with minDiscount set larger than MAX_BPS, the only impact will be setDiscount() always revert, so that the admin need to setDiscountLimits() correctly first.

https://github.com/code-423n4/2022-04-badger-citadel/blob/main/src/Funding.sol#L265-L271