search

sherlock-audit / 2023-04-blueberry-judging

8 stars 5 forks source link

SanketKogekar - Incorrect `liqThreshold` check in `BlueBerryBank.addBank()` #146

Closed sherlock-admin closed 1 year ago

sherlock-admin commented 1 year ago

SanketKogekar

medium

Incorrect liqThreshold check in BlueBerryBank.addBank()

Summary

liqThreshold could be less than or equal to Constants.MIN_LIQ_THRESHOLD and also could be greater than or equal to Constants.DENOMINATOR.

Vulnerability Detail

Having liqThreshold is on the edge (upper/lower limits), is not allowed.

Impact

If liqThreshold is on the edge (upper/lower limits), it would still revert.

if (liqThreshold > Constants.DENOMINATOR)
            revert Errors.LIQ_THRESHOLD_TOO_HIGH(liqThreshold);
if (liqThreshold < Constants.MIN_LIQ_THRESHOLD)
            revert Errors.LIQ_THRESHOLD_TOO_LOW(liqThreshold);

Code Snippet

https://github.com/sherlock-audit/2023-04-blueberry/blob/main/blueberry-core/contracts/BlueBerryBank.sol#L248

Tool used

Manual Review

Recommendation

Consider replacing it by following code

if (liqThreshold >= Constants.DENOMINATOR)
            revert Errors.LIQ_THRESHOLD_TOO_HIGH(liqThreshold);
if (liqThreshold <= Constants.MIN_LIQ_THRESHOLD)
            revert Errors.LIQ_THRESHOLD_TOO_LOW(liqThreshold);