Submission Details
Impact:
Likelihood:
`Function:deposit` lack asset check, leading meaningless function operation
[L-1] Function:deposit lack asset check, leading meaningless function operation
Description
The deposit function calculates the participation fee and attempts to transfer assets from the user, but it does not explicitly check whether the user has enough token balance before proceeding:
uint256 fee = _getParticipationFee(assets);
// No check for IERC20(asset()).balanceOf(msg.sender) >= assets
Impact
-
If the user has insufficient balance, safeTransferFrom will revert.
-
The function may appear to succeed in the logic flow before revert, leading to misleading expectations.
-
Lacks clear, early feedback to the user that their balance is insufficient.
Recommended mitigation
+uint256 balance = IERC20(asset()).balanceOf(msg.sender);
+if (balance < assets) {
+ revert("Insufficient balance to deposit");
+}
Rewards breakdown
nSLOC
193This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.