Asymmetry contest - idkwhatimdoing's results

Lines of code

https://github.com/code-423n4/2023-03-asymmetry/blob/main/contracts/SafEth/SafEth.sol#L87

Vulnerability details

Impact

The stake() function in the contract allows the contract owner to define the weight of each derivative used in the calculation of the total stake value. If this is set to zero, no safeEth token is minted but is instead transferred to the contract owner

Proof of Concept

If a derivative is set with a weight of zero: the proceeding code block which determines the mintAmount in the stake() function is skipped and any msg.value sent to the function is not used to mint tokens, but instead is transferred to the contract owner.

Tools Used

Manual Review

Recommended Mitigation Steps

It is recommended to modify the stake() function to handle the case when a derivative's weight is set to zero. One possible solution could be to check if the weight is zero and revert the transaction if this is the case, to prevent users from losing their funds. Alternatively, the contract owner could be prevented from setting the weight of a derivative to zero altogether.