search

code-423n4 / 2023-08-reserve-mitigation-findings

0 stars 0 forks source link

M-04 MitigationConfirmed #22

Closed code423n4 closed 1 year ago

code423n4 commented 1 year ago

Lines of code

Vulnerability details

Comments

The migration update the lastPayout and lastPayoutBal storage in the catch block. So even the melt function revert for the notFrozen check, the FurnaceP1.setRatio can also work normally.

try this.melt() {} catch {
                uint48 numPeriods = uint48((block.timestamp) - lastPayout) / PERIOD;
                lastPayout += numPeriods * PERIOD;
                lastPayoutBal = rToken.balanceOf(address(this));
            }
c4-judge commented 1 year ago

0xean marked the issue as nullified