code-423n4 / 2023-11-shellprotocol-findings

7 stars 7 forks source link

convertedAmount set to zero because of bad math arithmetic #334

Closed c4-bot-1 closed 8 months ago

c4-bot-1 commented 8 months ago

Lines of code

https://github.com/0xjarix/Audits/blob/0e8ef11ad54d410803a6c5a04a88641fa40d6f59/Code4rena/ShellProtocol-security-review.md?plain=1#L12

Vulnerability details

Impact

Detailed description of the impact of this finding. The pool will be able to give an outputAmount corresponding to the rawInputAmount = 0

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept. https://github.com/0xjarix/Audits/edit/main/Code4rena/ShellProtocol-security-review.md#h-1-bad-math-arithmetics-when-converting-for-swaps-and-liquidity-provision

Tools Used

Manual Analysis

Recommended Mitigation Steps

No idea

Assessed type

Math

c4-pre-sort commented 8 months ago

raymondfam marked the issue as insufficient quality report

c4-pre-sort commented 8 months ago

raymondfam marked the issue as primary issue

raymondfam commented 8 months ago

Insufficient proof.

c4-judge commented 8 months ago

0xA5DF marked the issue as unsatisfactory: Insufficient proof