Fractional v2 contest - auditor0517's results

Lines of code

https://github.com/code-423n4/2022-07-fractional/blob/8f2697ae727c60c93ea47276f8fa128369abfe51/src/modules/Migration.sol#L433-L482

Vulnerability details

Impact

Users might steal more shares of new fractions using Migration.migrateFractions(). This function is called after successful migration and it doesn't reset the user's contribution.

Proof of Concept

The user's contribution must be reset after this one.

Otherwise users can get additional shares by calling this function repeatedly.

Tools Used

Manual Review

Recommended Mitigation Steps

Recommend inserting below codes at L464

userProposalEth[_proposalId][msg.sender] = 0;
userProposalFractions[_proposalId][msg.sender] = 0;