search

sherlock-audit / 2023-04-splits-judging

4 stars 1 forks source link

chaduke - createDiversifier() lacks the check that ensures that the sum of all ``sortedPercentAllocations`` is equal to 100% #95

Closed sherlock-admin closed 1 year ago

sherlock-admin commented 1 year ago

chaduke

high

createDiversifier() lacks the check that ensures that the sum of all sortedPercentAllocations is equal to 100%

Summary

createDiversifier() lacks the check that ensures that the sum of all sortedPercentAllocations is equal to 100%. The impact is that either the incoming tokens will not be sufficient to cover all recipient accounts, or some incoming tokens will be stuck in the account.

Vulnerability Detail

createDiversifier() allows a user to create a passThroughWallet as a diversifier, and then connect it to a list of swappers as recipients.

https://github.com/sherlock-audit/2023-04-splits/blob/main/splits-diversifier/src/DiversifierFactory.sol#L66-L91

It is important to check and ensure that the sum of all sortedPercentAllocations is equal to 100%. However, the function does not have such a check.

Impact

Due to the lack of check mentioned above, the incoming tokens will not be sufficient to cover all recipient accounts, or some incoming tokens will be stuck in the account.

Code Snippet

See above

Tool used

VSCode

Manual Review

Recommendation

Check and ensure that the sum of all sortedPercentAllocations is equal to 100% .

Duplicate of #88