sherlock-audit / 2023-04-blueberry-judging

8 stars 5 forks source link

SanketKogekar - The function `takeCollateral()` from `BlueBerryBank.sol` accepts 0 amount of tokens from the user #152

Closed sherlock-admin closed 1 year ago

sherlock-admin commented 1 year ago

SanketKogekar

medium

The function takeCollateral() from BlueBerryBank.sol accepts 0 amount of tokens from the user

Summary

The function takeCollateral() from BlueBerryBank.sol accepts 0 amount of tokens which can possibly to lead to unexpected behaviour

Vulnerability Detail

The function takeCollateral() from BlueBerryBank.sol accepts 0 amount of tokens which can cost unnecessary gas fee to caller.

Impact

The function takeCollateral() from BlueBerryBank.sol accepts 0 amount which can

/// @dev Take some collateral back. Must only be called during execution.
    /// @param amount The amount of tokens to take back via transfer.
    function takeCollateral(
        uint256 amount //!! INPUT VALUE OVER HERE
    ) external override inExec returns (uint256) {
        Position storage pos = positions[POSITION_ID];
        if (amount == type(uint256).max) {
            amount = pos.collateralSize;
        }
        pos.collateralSize -= amount;
        IERC1155Upgradeable(pos.collToken).safeTransferFrom(
            address(this),
            msg.sender,
            pos.collId,
            amount,
            ""
        );
        emit TakeCollateral(
            POSITION_ID,
            msg.sender,
            pos.collToken,
            pos.collId,
            amount
        );

        return amount;
    }

Code Snippet

https://github.com/sherlock-audit/2023-04-blueberry/blob/main/blueberry-core/contracts/BlueBerryBank.sol#L794

Tool used

Manual Review

Recommendation

Check for amount == 0.