code423n4 commented 1 year ago

Lines of code

https://github.com/code-423n4/2023-06-canto/blob/main/Canto/x/coinswap/keeper/swap.go#L145

Vulnerability details

Impact

The condition says that if exactBoughtCoin is greater than or equal to outputReserve, then the call fails. But in my opinion, the call should be allowed if the two amounts are equal. (Maybe there are other reasons why we use GTE but it wasnt evident to me)

Code reference

https://github.com/code-423n4/2023-06-canto/blob/main/Canto/x/coinswap/keeper/swap.go#L145

    ...
    if exactBoughtCoin.Amount.GTE(outputReserve) {
        return sdk.ZeroInt(), sdkerrors.Wrap(types.ErrInsufficientFunds, fmt.Sprintf("reserve pool insufficient balance of %s, user expected: %s, actual: %s", exactBoughtCoin.Denom, exactBoughtCoin.Amount.String(), outputReserve.String()))
    }
    ...

Tools Used

Manual review

Recommended Mitigation Steps

Use GT instead of GTE

Assessed type

Other

c4-pre-sort commented 1 year ago

JeffCX marked the issue as low quality report

JeffCX commented 1 year ago

The report describe an expected behavior

c4-judge commented 1 year ago

0xean changed the severity to QA (Quality Assurance)