howlbot-integration[bot] commented 3 months ago

Lines of code

https://github.com/code-423n4/2024-07-reserve/tree/main/contracts/p1/RToken.sol#L452 https://github.com/code-423n4/2024-07-reserve/tree/main/contracts/p1/RToken.sol#L463

Vulnerability details

Impact

Admin can't set throttle amount as zero to solely rely on the issuance throttle rate. The same problem also exists in RToken.sol#setRedemptionThrottleParams.

Proof of Concept

RToken.sol#setIssuanceThrottleParams function is the following.

    function setIssuanceThrottleParams(ThrottleLib.Params calldata params) public governance {
452:    require(params.amtRate >= MIN_THROTTLE_RATE_AMT, "issuance amtRate too small");
        require(params.amtRate <= MAX_THROTTLE_RATE_AMT, "issuance amtRate too big");
        require(params.pctRate <= MAX_THROTTLE_PCT_AMT, "issuance pctRate too big");
        issuanceThrottle.useAvailable(totalSupply(), 0);

        emit IssuanceThrottleSet(issuanceThrottle.params, params);
        issuanceThrottle.params = params;
    }

Since constant MIN_THROTTLE_RATE_AMT = 1e18 > 0 in L452, params.amtRate can't be zero. However the docs stated that:

Must be at least 1 whole RToken. Can be set to 0 to solely rely on the issuance throttle rate.

Tools Used

Manual Review

Recommended Mitigation Steps

Modify RToken.sol#setIssuanceThrottleParams function as follows.

    function setIssuanceThrottleParams(ThrottleLib.Params calldata params) public governance {
--      require(params.amtRate >= MIN_THROTTLE_RATE_AMT, "issuance amtRate too small");
++      require(params.amtRate == 0 || params.amtRate >= MIN_THROTTLE_RATE_AMT, "issuance amtRate too small");
        require(params.amtRate <= MAX_THROTTLE_RATE_AMT, "issuance amtRate too big");
        require(params.pctRate <= MAX_THROTTLE_PCT_AMT, "issuance pctRate too big");
        issuanceThrottle.useAvailable(totalSupply(), 0);

        emit IssuanceThrottleSet(issuanceThrottle.params, params);
        issuanceThrottle.params = params;
    }