First Flight #21: KittyFi
First Flight #21
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

No check for amount in executeWhiskdrawal function

pro_king

Description

The executeWhiskdrawal function lacks proper checks to ensure that the user has sufficient balance (in terms of cattyNip) before allowing the withdrawal. This can lead to a situation where users can withdraw more than they have, potentially draining the balance of the protocol.

function executeWhiskdrawal(address _user, uint256 _cattyNipToWithdraw) external onlyPool {
uint256 _ameownt = _cattyNipToWithdraw.mulDiv(getTotalMeowllateral(), totalCattyNip);
userToCattyNip[_user] -= _cattyNipToWithdraw;
totalCattyNip -= _cattyNipToWithdraw;
totalMeowllateralInVault -= _ameownt;
IERC20(i_token).safeTransfer(_user, _ameownt);
}

Impact

This issue can lead to a complete drain of the protocol's funds, as users could withdraw more than their fair share of the collateral, leading to financial loss for other users and the protocol itself.

Tools Used

Manual Review

Recommendations

To mitigate this issue, add a check to ensure that the user has sufficient cattyNip balance before allowing the withdrawal. This can be done by comparing the _cattyNipToWithdraw with the user's current cattyNip balance.

Here is an updated version of the executeWhiskdrawal function with the necessary balance check:

function executeWhiskdrawal(address _user, uint256 _cattyNipToWithdraw) external onlyPool {
// Ensure the user has sufficient balance to withdraw the requested amount
require(userToCattyNip[_user] >= _cattyNipToWithdraw, "Insufficient balance to withdraw");
​
uint256 _ameownt = _cattyNipToWithdraw.mulDiv(getTotalMeowllateral(), totalCattyNip);
userToCattyNip[_user] -= _cattyNipToWithdraw;
totalCattyNip -= _cattyNipToWithdraw;
totalMeowllateralInVault -= _ameownt;
​
// Transfer tokens to the user
IERC20(i_token).safeTransfer(_user, _ameownt);

}

Updates

Lead Judging Commences

shikhar229169 Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.