Open c4-bot-8 opened 4 months ago
https://github.com/code-423n4/2024-04-panoptic/blob/58dda1b3b74e48f4d924731ec5da14096043fde0/contracts/CollateralTracker.sol#L420
due to the improper check, system is possible to mint more token than it should, and the maxMint limit may not work
maxMint
we have maxMint check function defined :
function maxMint(address) external view returns (uint256 maxShares) { unchecked { return (convertToShares(type(uint104).max) * DECIMALS) / (DECIMALS + COMMISSION_FEE); } }
but in actual mint function, we do not use this function:
function mint(uint256 shares, address receiver) external returns (uint256 assets) { assets = previewMint(shares); @> if (assets > type(uint104).max) revert Errors.DepositTooLarge(); ...
we just use type(uint104).max instead of maxMint,which makes the maxmint check not work properly
type(uint104).max
maxmint
manual
change to maxMint check
Invalid Validation
Picodes marked the issue as duplicate of #553
Picodes marked the issue as satisfactory
Picodes changed the severity to QA (Quality Assurance)
Picodes marked the issue as grade-b
Lines of code
https://github.com/code-423n4/2024-04-panoptic/blob/58dda1b3b74e48f4d924731ec5da14096043fde0/contracts/CollateralTracker.sol#L420
Vulnerability details
Impact
due to the improper check, system is possible to mint more token than it should, and the
maxMint
limit may not workProof of Concept
we have
maxMint
check function defined :but in actual mint function, we do not use this function:
we just use
type(uint104).max
instead ofmaxMint
,which makes themaxmint
check not work properlyTools Used
manual
Recommended Mitigation Steps
change to
maxMint
checkAssessed type
Invalid Validation