Frankencoin - carlitox477's results

Lines of code

https://github.com/code-423n4/2023-04-frankencoin/blob/1022cb106919fba963a89205d3b90bf62543f68f/contracts/Position.sol#L97-L101

Vulnerability details

Description

According to code comment, Position.reduceLimitForClone(uint256) should Adjust this position's limit to give away half of the remaining limit to the clone.

This requirement is not meet by the function.

Impact

Allows someone how is cloning a position to get more than half of the remaining limit.

POC

https://gist.github.com/carlitox477/c80c5b1d660709d4f6b68b20d1e5b6d6

Mitigation steps

The reduction should be done by just \frac{limit - minted}{2} according to comments. This means that parameter _minimum should not be taken into account when reduceLimitForClone is called, given that the remaining limit = limit - minted. This means:

function reduceLimitForClone() external noChallenge noCooldown alive onlyHub returns (uint256) {
    uint256 reduction = (limit - minted)/2; // this will fail with an underflow if minimum is too high
    limit -= reduction;
    return reduction;
}