search

code-423n4 / 2024-01-opus-findings

0 stars 0 forks source link

Redistributed yang remains unclaimable during shutdown #220

Closed c4-bot-7 closed 9 months ago

c4-bot-7 commented 10 months ago

Lines of code

https://github.com/code-423n4/2024-01-opus/blob/main/src/core/caretaker.cairo#L262

Vulnerability details

Impact

Loss of collateral for user, when system is shutdown. In case of redistributed yangs with exception which is attributed to a trove, where yang balance is increased, it won't be reflected in user's deposits during shutdown and claim process leading to loss of fund for user which will be locked up in system forever

Tools Used

VS Code

Recommended Mitigation Steps

Add following call in release function of caretaker

shrine.get_redistributions_attributed_to_trove(trove_id)

and use these yang balances in release function

Assessed type

Other

c4-pre-sort commented 9 months ago

bytes032 marked the issue as insufficient quality report

c4-pre-sort commented 9 months ago

bytes032 marked the issue as primary issue

c4-pre-sort commented 9 months ago

bytes032 marked the issue as sufficient quality report

c4-pre-sort commented 9 months ago

bytes032 marked the issue as duplicate of #100

c4-judge commented 9 months ago

alex-ppg marked the issue as partial-75