code423n4 commented 1 year ago

Lines of code

https://github.com/code-423n4/2023-03-mute/blob/4d8b13add2907b17ac14627cfa04e0c3cc9a2bed/contracts/amplifier/MuteAmplifier.sol#L419

Vulnerability details

Impact

dripsInfo is not correct when there is no deposit and returns wrong perSecondReward.

Proof of Concept

MuteAmplifier.dripsInfo calculates perSecondReward as follows:

    info.perSecondReward = totalRewards.div(endTime.sub(firstStakeTime));

firstStakeTime is 0 when there is no deposit, so perSecondReward will be a wrong value when there is no deposit and firstStakeTime = 0.

Tools Used

Manual Review

Recommended Mitigation Steps

When firstStakeTime = 0, perSecondReward has no meaning, so it is better to return 0.

HollaDieWaldfee100 commented 1 year ago

@Picodes I think the L-08 and L-09 findings from my QA report should somehow be grouped with this medium. I also pointed out another issue with this function there. https://github.com/code-423n4/2023-03-mute-findings/blob/main/data/HollaDieWaldfee-Q.md

c4-sponsor commented 1 year ago

mattt21 marked the issue as disagree with severity

mattt21 commented 1 year ago

This is a view only function that is used for our front end to display values. This does nothing to the functionality of the contract. Should be a low risk bug.

Picodes commented 1 year ago

Downgrading to Low per C4's docs (state handling).

Picodes commented 1 year ago

@HollaDieWaldfee100, thanks for flagging

c4-judge commented 1 year ago

Picodes changed the severity to QA (Quality Assurance)

code-423n4 / 2023-03-mute-findings