code423n4 commented 1 year ago

Lines of code

https://github.com/prepo-io/prepo-monorepo/blob/feat/2022-12-prepo/apps/smart-contracts/core/contracts/PrePOMarket.sol#L76-L107

Vulnerability details

Impact

Users may receive error messages fee = 0 whenever making a redemption from PrePOMarket contract if the redemption amout is not enough. The error message is irrelevant to users. It's related to the protocol processing the redemption. If a user receives multiple such messages, it may worry the user who has no idea what's happening. Users may suspect if their assets are still under their control.

Proof of Concept

Assume: the user has sufficient balance of assets for redemption. finalLongPayout > MAX_PAYOUT; FEE_DENOMINATOR = 1000000; redemptionFee = 100. The user call redeem(_amount, _amount):

when _amount = 100, fail with fee = 0 error
when _amount = 1000, fail with fee = 0 error
when _amount = 5000, fail with fee = 0 error
when _amount = 10000, succeed.

Tools Used

N/A

Recommended Mitigation Steps

Improve the error message that should include actual reasons of transaction fail, and the required minmum amount of redemption. Or, implement some other fee strategies.

c4-judge commented 1 year ago

Picodes marked the issue as unsatisfactory: Invalid

Picodes commented 1 year ago

Please do not submit the same finding multiple times.

code-423n4 / 2022-12-prepo-findings