Spectra - Franklin's results

Lines of code

https://github.com/code-423n4/2024-02-spectra/blob/383202d0b84985122fe1ba53cfbbb68f18ba3986/src/tokens/PrincipalToken.sol#L483

Vulnerability details

Impact

From the docs, it says that Principal token is an EIP-5095 compliant

This is the core contract of Spectra. The Principal Token is EIP-5095 and EIP-2612 compliant.

But it doesnt follow the standards correctly. As per EIP-5095, the maxRedeem MUST factor in both global and user-specific limits, like if redemption is entirely disabled (even temporarily) it MUST return 0. This is not the case currently, as even if the contract is paused, the maxRedeem method will still return the maxBurnable for the caller.

Tools Used

Recommended Mitigation Steps

Go through the standard and follow it for all methods that override methods from ERC5095 implementation.

Assessed type

Other