search

sherlock-audit / 2023-06-Index-judging

6 stars 2 forks source link

twcctop - compents may change after deposit #62

Closed sherlock-admin2 closed 1 year ago

sherlock-admin2 commented 1 year ago

twcctop

high

compents may change after deposit

Summary

BasicIssuanceModule.sol enables issuance and redemption functionality on a SetToken。One SetToken has different components; the issue is after calling the function issue(deposit) token, components may change. In this situation, the user may get fewer tokens.

Vulnerability Detail

  1. user calls BasicIssuanceModule#issue deposit token
  2. setToken call removeComponent, remove component
  3. user calls redeem get fewer token

    Impact

    user mat gets fewer token

    Code Snippet

    https://github.com/sherlock-audit/2023-06-Index/blob/main/index-protocol/contracts/protocol/modules/v1/BasicIssuanceModule.sol#L144-L145

https://github.com/sherlock-audit/2023-06-Index/blob/main/index-protocol/contracts/protocol/modules/v1/BasicIssuanceModule.sol#L105

Tool used

Manual Review

Recommendation

add component data to cache，