code423n4 commented 1 year ago

Lines of code

https://github.com/code-423n4/2023-04-frankencoin/blob/main/contracts/Position.sol#L109 https://github.com/code-423n4/2023-04-frankencoin/blob/main/contracts/Equity.sol#L209

Vulnerability details

Impact

When the Frankencoin and Reserve contract are first deployed and no reserve shares have been minted, a malicious user can thwart and call deny on any Position, wasting large amounts of their gas and preventing them from minting Frankencoin.

Proof of Concept

    //@audit inside Position.sol
    function deny(address[] calldata helpers, string calldata message) public {

        if (block.timestamp >= start) revert TooLate();

        //@audit here it is checked if the msg.sender is qualified to deny this position
        IReserve(zchf.reserve()).checkQualified(msg.sender, helpers);
        cooldown = expiration; // since expiration is immutable, we put it under cooldown until the end
        emit PositionDenied(msg.sender, message);
    }

    //@audit inside Equity.sol
    function checkQualified(address sender, address[] calldata helpers) public override view {
        uint256 _votes = votes(sender, helpers);
        //@audit here if _votes and totalVotes() are both zero then this conditional wont revert and the denial request will go through
        if (_votes * 10000 < QUORUM * totalVotes()) revert NotQualified();
    }