First Flight #21: KittyFi
First Flight #21
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Lack of Check control in `meowintKittyCoin` funtion

pro_king

Description

In the KittyPool::meowintKittyCoin function, there is no check to verify if the user has enough collateral before allowing them to mint KittyCoin. This oversight can result in users minting any amount of KittyCoin without adequate collateral backing, leading to potential destabilization of the protocol.

function meowintKittyCoin(uint256 _ameownt) external {
kittyCoinMeownted[msg.sender] += _ameownt;
i_kittyCoin.mint(msg.sender, _ameownt);
require(_hasEnoughMeowllateral(msg.sender), KittyPool__NotEnoughMeowllateralPurrrr());
}

Impact

Allowing users to mint KittyCoin without ensuring sufficient collateral can lead to:

  • Protocol Instability: If users mint more KittyCoin than their collateral can support, it may result in a deficit in the system, causing potential insolvency.

  • Loss of Confidence: Users may lose confidence in the protocol's stability and security if they perceive that the system can be manipulated to mint unbacked tokens.

  • Economic Exploits: Malicious actors might exploit this flaw to drain the protocol's funds or create hyperinflation within the system.

Tools Used

Manual Review

Recommendations

To ensure that users cannot mint more KittyCoin than their collateral allows, implement a collateral check before updating the user's minted amount and minting new tokens. Here’s an updated version of the meowintKittyCoin function with the necessary checks:

function meowintKittyCoin(uint256 \_ameownt) external {\
// Calculate the new total minted amount if this minting were to proceed\
uint256 newTotalMinted = kittyCoinMeownted\[msg.sender] + \_ameownt;
​
// Temporarily update the minted amount to check if the user has enough collateral
uint256 previousMinted = kittyCoinMeownted[msg.sender];
kittyCoinMeownted[msg.sender] = newTotalMinted;
​
// Check if the user has enough collateral for the new total minted amount
require(_hasEnoughMeowllateral(msg.sender), KittyPool__NotEnoughMeowllateralPurrrr());
​
// If the check passes, proceed with minting
i_kittyCoin.mint(msg.sender, _ameownt);
​
// If the check fails, revert the temporary update
kittyCoinMeownted[msg.sender] = previousMinted;
​
// Finally, update the minted amount permanently
kittyCoinMeownted[msg.sender] = newTotalMinted;
}
Updates

Lead Judging Commences

shikhar229169 Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.