sherlock-audit / 2024-06-magicsea-judging

8 stars 5 forks source link

Skinny Pine Mink - Input argument "amount" should be checked for value greater then 0 #713

Closed sherlock-admin3 closed 4 months ago

sherlock-admin3 commented 4 months ago

Skinny Pine Mink

Low/Info

Input argument "amount" should be checked for value greater then 0

Arcanet

low

Summary

MlumStaking.createPosition function input argument "amount" should be checked for value greater then 0 before calling _transferSupportingFeeOnTransfer(stakedToken, msg.sender, amount)

Vulnerability Detail

Function arguments check

Impact

Safe gas

Code Snippet

https://github.com/sherlock-audit/2024-06-magicsea/blob/main/magicsea-staking/src/MlumStaking.sol#L354

function createPosition(uint256 amount, uint256 lockDuration) external override nonReentrant {
// no new lock can be set if the pool has been unlocked
if (isUnlocked()) {
      require(lockDuration == 0, "locks disabled");
}
_updatePool();

// handle tokens with transfer tax
amount = _transferSupportingFeeOnTransfer(stakedToken, msg.sender, amount);
require(amount != 0, "zero amount"); // createPosition: amount cannot be null

Tool used

Manual Review

Recommendation

https://github.com/sherlock-audit/2024-06-magicsea/blob/main/magicsea-staking/src/MlumStaking.sol#L361

Add require(amount != 0, "zero amount"); before calling another function with this function input value