Summary

The setAmountPerRound() function, which updates the amountPerRound during the Withdraw phase, does not check if the treasury balance is sufficient to cover this new limit for the next cycle.

Vulnerability Details

The owner of user agent can update amountPerRound by calling setAmountPerRound() during the Withdraw phase. However, this function lacks a check to ensure the treasury balance is sufficient to meet the updated amountPerRound value. Without this balance sufficiency check, the buy agent may not have enough assets to fulfill the purchase limit in the next cycle.

Impact

This missing check could lead to purchase failures, causing user who paid royalties fees frustration.

Tools Used

vscode

Recommendations

Implement a check within setAmountPerRound() to confirm that the treasury balance is sufficient to cover the new amountPerRound plus swan.getOracleFee().