Submission Details
Severity:
The withdrawal amount should be greater than 0
Summary
Because the user can input an amount equal to 0, lock owners can potentially spam the withdraw() function to keep updateNeeded always equal to 1. This can result in unnecessary gas consumption for the system when calling CCIP to update the system.
Test
it('Possible to withdraw 0 tokens', async () => {
await mintLock(false)
await expect(sdlPool.withdraw(1, 0)).to.be.emit(sdlPool, "QueueWithdraw")
assert.equal(await sdlPool.shouldUpdate(), true)
})
Recommendations
Consider adding a requirement for the withdrawal amount to always be greater than 0:
function withdraw(uint256 _lockId, uint256 _amount)
external
onlyLockOwner(_lockId, msg.sender)
updateRewards(msg.sender)
{
if (_amount == 0) revert InvalidValue(); // <- @AUDIT - add here
...
emit QueueWithdraw(msg.sender, _lockId, _amount);
}
Similarly to the withdraw function in the
SDLPoolPrimarycontract, it would be clearer to check if the entered amount is different from 0.
Prize pool breakdown
Total prize
27,500 USDC
nSLOC
1,41419 USDC / LOC
25,000 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.