Closed code423n4 closed 1 year ago
0xA5DF marked the issue as primary issue
Severity seems med, since no funds are lost
The operating assumption is that whoever deploys the smart contract will mint the first shares immediately afterwards.
And even if that did not happen, whoever creates the first position could simply create a few pool shares before doing so.
--> Not a relevant issue.
luziusmeisser marked the issue as sponsor disputed
hansfriese changed the severity to QA (Quality Assurance)
hansfriese marked the issue as grade-c
Lines of code
https://github.com/code-423n4/2023-04-frankencoin/blob/main/contracts/Position.sol#L109 https://github.com/code-423n4/2023-04-frankencoin/blob/main/contracts/Equity.sol#L209
Vulnerability details
Impact
When the Frankencoin and Reserve contract are first deployed and no reserve shares have been minted, a malicious user can thwart and call
deny
on anyPosition
, wasting large amounts of their gas and preventing them from minting Frankencoin.Proof of Concept
Tools Used
Manual Review
Recommended Mitigation Steps
In addition to a percentage of the total pool, require a minimum amount of reserve shares before an individual is qualified to vote