`totalCollateralValueInUsd` can be doubled due to mistake in `constructor` arguments
Summary
Due to mistakes in constructor arguments a collateral token can be added twice. When the s_collateralDeposited[user][token] will be counted twice in the getAccountCollateralValue function.
Vulnerability Details
constructor does not check if a collateral token was already pushed in s_collateralTokens. At the same time the token will be stored correctly again in s_priceFeeds mapping.
A user can deposit the token as collateral and receive twice more DSC due to double counting the collateral in the getAccountCollateralValue. It will be read twice from s_collateralTokens in the for-loop
Impact
Users can receive more DSC tokens than expected.
Tools Used
Manual review
Recommendations
I suggest adding a corresponding check in constructor function.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.