Party DAO - 0xA5DF's results

Lines of code

https://github.com/code-423n4/2023-10-party/blob/053fb9345b0739b3c26d12e1eae1eefbfd70b223/contracts/party/PartyGovernanceNFT.sol#L426-L432

Vulnerability details

During rage quit the rage quitter supplies a list of tokens to take a fair share of and the expected minimum amount out. If the share of any of the tokens is less than the minimum then the function reverts. However, if the share is zero then the minimum amount is ignored and the function doesn't revert. A user might be rage quitting during a proposal execution that empties out a token (e.g. the party is purchasing an NFT) expecting the function to revert if the proposal was executed already. But in that case the function wouldn't revert and the user would end up losing a part of their share.

Impact

Rage quitter might get less than the fair share they deserve

Proof of Concept

In the following code snippet it can be seen that the check is done only if amount > 0

                if (amount > 0) {
                    uint256 minAmount = minWithdrawAmounts[i];

                    // Check amount is at least minimum.
                    if (amount < minAmount) {
                        revert BelowMinWithdrawAmountError(amount, minAmount);
                    }

Recommended Mitigation Steps

In case that amount is zero - revert if the minimum amount is greater than zero

Assessed type

Other