Summary:

In the _getMintAmount function, the calculated mintAmount is not returned due to the absence of a return statement. This leads to the function performing calculations without producing a usable result, potentially causing logic errors in the contract where this function is called and relied upon for minting operations.

Vulnerability Details:

This is logic error absence of return mintAmount in _getMintAmount function which Call internaly by getMintAmount function and also uses in minting and others function like canDistribute

Level

High-Critical

Impact:

The mintAmount calculated by the function is never utilized. This can cause subsequent logic in the contract to malfunction, leading to potential vulnerabilities such as:

• Incorrect token minting amounts.

• Failure to mint tokens when expected.

• Discrepancies in token supply calculations.

• The functions that depend on the mintAmount not work as expected

Proof of Concept / Explanation

Consider the following scenario where _getMintAmount is called within another function to determine the amount of tokens to mint:

• Without a return statement in _getMintAmount, amountToMint will always be zero, and no tokens will be minted regardless of the intended calculations.

_getMintAmount function from contract:

• When _getMintAmount is called, it performs the calculations but does not return the result, causing amountToMint to be zero.

Tools Used:

Manual, Foundry

Recommendations:

To resolve this issue, a return mintAmount; statement must be added at the end of the _getMintAmount function to ensure the calculated value is returned and can be used by the calling function.

Revised _getMintAmount function with return statement:

By adding the return statement, the function will correctly return the mintAmount value