Closed code423n4 closed 1 year ago
https://github.com/code-423n4/2023-01-ondo/blob/f3426e5b6b4561e09460b2e6471eb694efdd6c70/contracts/cash/CashManager.sol#L596
mintlimit can be lower than the usual mint limit, resulting in accounting error. Admin can change mint limit halfway and users cannot mint suddenly.
The adming controls the setMintLimit() and _mintLimit can be smaller than the oldMintLimit. Also, _mintLimit can be set to zero
function setMintLimit(uint256 _mintLimit) external onlyRole(MANAGER_ADMIN) { uint256 oldMintLimit = mintLimit; mintLimit = _mintLimit; emit MintLimitSet(oldMintLimit, _mintLimit); }
Manual Review
Make sure the mint limit cannot be set lower in the current epoch. Also, check for zero value.
Duplicate of https://github.com/code-423n4/2023-01-ondo-findings/issues/366
trust1995 marked the issue as grade-b
Lines of code
https://github.com/code-423n4/2023-01-ondo/blob/f3426e5b6b4561e09460b2e6471eb694efdd6c70/contracts/cash/CashManager.sol#L596
Vulnerability details
Impact
mintlimit can be lower than the usual mint limit, resulting in accounting error. Admin can change mint limit halfway and users cannot mint suddenly.
Proof of Concept
The adming controls the setMintLimit() and _mintLimit can be smaller than the oldMintLimit. Also, _mintLimit can be set to zero
Tools Used
Manual Review
Recommended Mitigation Steps
Make sure the mint limit cannot be set lower in the current epoch. Also, check for zero value.