First Flight #21: KittyFi
First Flight #21
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: low
Valid

User Unable to Withdraw All Deposited Collateral

ayamercy

Summary

Users are unable to withdraw the entirety of their deposited collateral in a single transaction using the KittyPool::whiskdrawMeowllateral function. The transaction reverts with an error related to a division or modulo by zero.

Vulnerability Details

When a user attempts to withdraw their entire deposited collateral using the whiskdrawMeowllateral function, the transaction fails and reverts. The error message indicates a division or modulo by zero, which suggests a flaw in the logic handling the calculation or validation of the withdrawal amount. The issue is tied to the fact that the user withdraws his collateral then checks if they have enough collateral but after the withdrawal.

The relevant code snippet is shown below:

function whiskdrawMeowllateral(address _token, uint256 _ameownt) external tokenExists(_token) {
@> IKittyVault(tokenToVault[_token]).executeWhiskdrawal(msg.sender, _ameownt);
require(_hasEnoughMeowllateral(msg.sender), KittyPool__NotEnoughMeowllateralPurrrr());
}

PoC:

Add the following to KittyFiTest.t.sol test file:

function test_userWithdrawAllCollateral() public {
uint256 amount = 5 ether;
​
vm.startPrank(user);
// 1. user deposits 5 eth
IERC20(weth).approve(address(wethVault), amount);
kittyPool.depawsitMeowllateral(weth, amount);
​
// 2. user wihdraws all his deposited collater (i.e, 5 eth) -> reverts
vm.expectRevert();
kittyPool.whiskdrawMeowllateral(weth, amount);
​
vm.stopPrank();
}

Impact

  • User Inconvenience: Users are unable to withdraw their entire collateral, potentially leading to a loss of confidence in the platform.

  • Liquidity Issues: Users might face liquidity issues if they are unable to retrieve their funds when needed.

  • Financial Risk: Inability to withdraw collateral could expose users to financial risks if they cannot access their funds in a timely manner.

Tools Used

  • Manual review

  • Foundry

Recommendations

Fix the function as follows:

function whiskdrawMeowllateral(address _token, uint256 _ameownt) external tokenExists(_token) {
- IKittyVault(tokenToVault[_token]).executeWhiskdrawal(msg.sender, _ameownt);
- require(_hasEnoughMeowllateral(msg.sender), KittyPool__NotEnoughMeowllateralPurrrr());
+ require(_hasEnoughMeowllateral(msg.sender), KittyPool__NotEnoughMeowllateralPurrrr());
+ IKittyVault(tokenToVault[_token]).executeWhiskdrawal(msg.sender, _ameownt);
}
Updates

Lead Judging Commences

shikhar229169 Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

totalCattyNip being 0 makes getUserMeowllateral to revert causing dependent functions to revert

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.