In the provide_liquidity
instruction, users can deposit amount_a
(Token A) without any check to ensure it’s greater than zero.
Right now, someone could call this function with amount_a = 0
, which doesn’t make sense—you shouldn’t be able to provide "zero liquidity" and still trigger pool changes.
Wasted Gas & Clutter: Users (or bots) could spam transactions with amount_a = 0
, bloating the blockchain with useless operations.
Unexpected Behavior: Some parts of the contract might assume deposits are always positive, leading to weird edge cases.
Potential Exploits: While not directly stealing funds, attackers could abuse this to create fake LP positions or disrupt pool accounting.
This ensures nobody can deposit zero tokens.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.