hats-finance / Possum-Labs--Portals--0xed8965d49b8aeca763447d56e6da7f4e0506b2d3

GNU General Public License v2.0
0 stars 2 forks source link

Some methods are missing existingAccount() modifier check #58

Open hats-bug-reporter[bot] opened 1 year ago

hats-bug-reporter[bot] commented 1 year ago

Github username: @cpp-phoenix Twitter username: aarambh_audits Submission hash (on-chain): 0x769d0a962f4767022b9e0764f8bf8239ed5619a85b22f2fa0d4a553caadd50e8 Severity: low

Description: Description\ The methods mintPortalEnergyToken() & burnPortalEnergyToken() is missing the existingAccount() check. Although the txn will revert later on in the execution. It is good practice to add the modifier as the methods rely on user to have an account to mint or burn portal energy

PossumLabsCrypto commented 1 year ago

Thank you but this is not a vulnerability.

burnPortalEnergyTocken() should even be callable by people without an active stake history, i.e. without initialized account. They can just not set themselves as recipient of the internal balance because that would need an active account.

Without an active account it is virtually impossible to call mintPortalEnergyToken.