hats-finance / Intuition-0x538dbadc50cc87b281cd655f1edbc6ebda02a66a

The smart contracts of the Intuition protocol v1.
https://intuition.systems
Other
0 stars 1 forks source link

Users cannot deploy tripple counter vauls #39

Open hats-bug-reporter[bot] opened 1 week ago

hats-bug-reporter[bot] commented 1 week ago

Github username: @0x3b33 Twitter username: -- Submission hash (on-chain): 0xf6a385f2f693e57a2486ca4a42e5da3f4c030dbe3e5a690bace66441c7b7e565 Severity: high

Description: Description\ deployAtomWallet is used to deploy vaults. Any vault can be deployed as long as its ID is valid (greater than 0 and not greater than the count). If these conditions are met, deployAtomWallet can deploy both normal wallets and triple vaults.

    function deployAtomWallet(uint256 atomId) external whenNotPaused returns (address) {
        if (atomId == 0 || atomId > count) {
            revert Errors.MultiVault_VaultDoesNotExist();
        }

However, the issue is that triple vaults have a normal vault (Id 1, 2, 3,...) and a counter vault with an Id of uint256.max - normalId. deployAtomWallet will not work for deploying a triple counter vault because of the check atomId > count, as their IDs starts from the max and goes down.

Recommendation\ Include a check to enable counter triple vaults to be deployed.

    function deployAtomWallet(uint256 atomId) external whenNotPaused returns (address) {
-         if (atomId == 0 || atomId > count) {
+         if (atomId == 0 || (atomId > count && atomId < type(uint256).max - count)) {
             revert Errors.MultiVault_VaultDoesNotExist();
         }
mihailo-maksa commented 4 days ago

The report is invalid. The deployAtomWallet function is specifically designed for deploying atom wallets and is not intended for triple vaults.

The current implementation of deployAtomWallet verifies that the atomId is within a valid range for atom wallets. Triple vaults and their counter vaults are managed through different mechanisms and do not require the deployAtomWallet function for their deployment. This separation of functionality ensures that each type of vault is deployed correctly and securely.

Therefore, the issue raised does not apply to the intended functionality of deployAtomWallet, and the current implementation works as designed.