Inconsistent state checks in LibLegacyTokenSilo::removeDepositFromAccount
Summary
The function checks if amount > crateAmount to decide whether to migrate legacy deposits. However, it proceeds to remove the legacy deposit regardless of whether the new calculated crateAmount and crateBDV are sufficient to cover the amount requested for removal. This could potentially lead to a state where deposits are removed even if they don't fully cover the amount,
Vulnerability Details
The function checks if amount > crateAmount to decide whether to migrate legacy deposits. However, it proceeds to remove the legacy deposit regardless of whether the new calculated crateAmount and crateBDV are sufficient to cover the amount requested for removal. This could potentially lead to a state where deposits are removed even if they don't fully cover the amount,
Impact
medium
Tools Used
Manual Review
Recommendations
check and make sure the the caller is the owner of the deposit
Lead Judging Commences
Informational/Invalid
Prize pool breakdown
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.