search

code-423n4 / 2023-08-pooltogether-mitigation-findings

0 stars 0 forks source link

M-11 MitigationConfirmed #17

Open code423n4 opened 1 year ago

code423n4 commented 1 year ago

Lines of code

Vulnerability details

Comments

The previous implementation included a mintWithPermit method that was supposed to allow users to mint a certain number of shares through a permit signature. However the signature would have to be signed with a specific value of _assets that isn’t known in advance (since it varies based on the exchange rate) and therefore it is probable that most/all calls to mintWithPermit would revert.

Mitigation

The implementation has been removed altogether which makes sense because it is impossible to know what value of _assets to sign a message for that will be valid at any given time in the future. depositWithPermit remains to allow entering into a vault with a permit, so this issue has been resolved.

Conclusion

LGTM

c4-judge commented 1 year ago

Picodes marked the issue as satisfactory

c4-judge commented 1 year ago

Picodes marked the issue as confirmed for report