Submission Details
Severity:
return i_tokenContract.balanceOf(address(this)) instead of i_price in getPrice function
summary
All functions in the contract work on i_tokenContract.balanceOf(address(this)) instead of i_price, because i_price and actual balance can be slightly different OR so much different because of some Tokens which modify balances outside transfer operations like UBI, AMPL, or aTokens from AAVE. It is better to return i_tokenContract.balanceOf(address(this))
and as i_price is useless, delete i_price.
Vulnerability Details
function getPrice() external view returns (uint256) {
return i_price;
}
Impact
As price affects sellers to do auditing, getting a different price from the actual price, affects their decisions.
Tools Used
manual review
Recommendations
- uint256 private immutable i_price;
- i_price = price;
function getPrice() external view returns (uint256) {
- return i_price;
+ return i_tokenContract.balanceOf(address(this));
}
Prize pool breakdown
Total prize
40,000 USDC
nSLOC
186215 USDC / LOC
37,000 USDC
3,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.