Open hats-bug-reporter[bot] opened 1 month ago
The minimum deposit amount is regulated on the frontend side
The minimum deposit amount is regulated on the frontend side
We don't know this details. Readme also didn't mention anything about this.
We saw that the withdraw is restricted with min value in the contract level. We were thinking that this is missed during deposit. It would be helpful if you could add such details in readme. So that we can focus on other potential vulnerabilities.
@rotcivegaf
@aktech297 you report don't provide the lines of the bug, and don't have any PoC
@aktech297 you report don't provide the lines of the bug, and don't have any PoC
Hi @rotcivegaf , Sponsor understood the submission and says the min deposit limit is enforced on the front end.
If we see the withdraw function , there is cap for minWithdrawalLimit
.
but if we see the deposit function, there is no such cap.
as we reported, it is not recommended to enforce it in the deposit function since the BTC is already deposited by the user.
By considering the above point, we suggested to include this with user deposit transaction.
sponsor says, it is enforced in the front end.
But, it will not save the user who directly interact with smart contract.
Github username: -- Twitter username: -- Submission hash (on-chain): 0x3c0c30604a71c369a106fc5dccb9d35c035497b074144e1d9198aa59980a52b8 Severity: medium
Description: Description\
This issue comes due to how the current deposit process is done and no minimum deposit requirement.
The current deosit process is,
If we see the btc token minting process, fee charging is done like protocol fee, importFees. The importFees is dynamic which acts based on the satoshiPerByte which is set by the owner.
When user deosit any BTC that does not cover these fee value, then BTC will be stuck and the VaultBitcoinWallet can not mint the btc token.
Following two aspects is root cause of this issue.
Impact\
As there are no min deposit limit, any BTC can be sent to mint the btc token. If the sent BTC does not cover the fees, the deposit can not be completed and user's BTC could stuck.
Attachments
In order to ensure smooth minting of btc tokne we would suggest the following.
When depositing the XBTC consider the fee (XBTC + Fee) and include this fee in the Tx hash.
When processing the deposit, deduct this fee from the total BTC and then proceed the minting of btc token.