The number of withdrawals was incorrectly calculated at the time of withdraw.
Summary
In the withdraw function, the mintFee update cost is not performed before the shareRatio is calculated in L67-L69. This causes the shareRatio to be calculated incorrectly and the withdrawing user will not be liable for the fee for a period of time.
Vulnerability Details
In the withdraw function, the mintFee update cost is not performed before the shareRatio is calculated in L67-L69. This causes the totalSupply to be small at this point and the calculated shareRatio to be large. That is, it makes the user who has not yet withdrawn fully bear the fee that the withdrawing user should bear.
Impact
This causes the shareRatio to be calculated incorrectly and the withdrawing user will not be liable for the fee for a period of time. More tokens will be withdrawn.
Tools Used
manual
Recommendations
It is recommended to mintFee at the beginning of withdraw.
Lead Judging Commences
Fee not accounted during withdrawal
Impact: High Likelihood: High User share amount is calculated before minting fee and the remaining users will need to more fee than reasonable.
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.