Frankencoin - eyexploit's results

notifiyRepainInternal() redundant check should be removed

Everytime owner repay zchf token to the system, it interally call notifyRepaidInternal(), under which its check the amount to be burn should not be greater than minted. If so revert it.

NOTE: minted state is used to account the total minted token so far.

    function notifyRepaidInternal(uint256 amount) internal {
        if (amount > minted) revert RepaidTooMuch(amount - minted); // @audit-issue redundtant check
        minted -= amount;
    }

notifyRepaidInternal() is getting used in two places, once when owner call repay() to burn some zchf token and when it notifies the position that a challenge was successful via notifyChallengeSucceeded().

The amount we burnt will always remain below the minted amount, that means the check if (amount > minted) revert RepaidTooMuch(amount - minted); is no useful.

Let's see how,

Case 1: minted represent total minted so far, if owner decide to burn some, the amount that owner burns will always less than the minted.

ex. if owner minted 100e18, it not possible for owner to burn more than 100e18.

Case 2:

    function notifyChallengeSucceeded(address _bidder, uint256 _bid, uint256 _size) external onlyHub returns (address, uint256, uint256, uint256, uint32) {
        ...
        uint256 volumeZCHF = _mulD18(price, _size); // How much could have minted with the challenged amount of the collateral
        // The owner does not have to repay (and burn) more than the owner actually minted.  
        uint256 repayment = minted < volumeZCHF ? minted : volumeZCHF; // how much must be burned to make things even

        notifyRepaidInternal(repayment); // we assume the caller takes care of the actual repayment
        ...
}

Here, repayment calculation show that volumeZCHF or amount we burn will always be less than or equal to minted.

Hence, the check in notifyRepaidInternal() is reduntant.

Recommendation Reduntant check consume unnecessary space in contract bytecode and also more gas while executing them. The simpler or less reduntant code helps in readibility and also avoiding unnecessary gas consumption.

Rewrite the notifyRepaidInternal func. to below

    function notifyRepaidInternal(uint256 amount) internal {
        minted -= amount;
    }