Canto Application Specific Dollars and Bonding Curves for 1155s - ksk2345's results

Lines of code

https://github.com/code-423n4/2023-11-canto/blob/335930cd53cf9a137504a57f1215be52c6d67cb3/asD/src/asD.sol#L72

Vulnerability details

Impact

When the user/owner decides to partially withdraw the interest accrued, there is no way to know the maximum amount that can be withdrawn upfront. The only way to know the amount is, pass 0 to method withdrawCarry, which then fully withdraws the maximum withdrawal accrued interest (not what the user wanted).

It impacts the partial withdrawal capability of user.

Tools Used

Manual review

Recommended Mitigation Steps

    function maxWithdrawableAmount() public view returns (uint256 maximumWithdrawable) {
        uint256 maximumWithdrawable = (CTokenInterface(cNote).balanceOf(address(this)) * exchangeRate) /
            1e28 -
            totalSupply();
        return maximumWithdrawable;
    }

Assessed type

Other