prePO contest - mert_eren's results

Lines of code

https://github.com/prepo-io/prepo-monorepo/blob/3541bc704ab185a969f300e96e2f744a572a3640/apps/smart-contracts/core/contracts/WithdrawHook.sol#L53-L80

Vulnerability details

Impact

when periods use code is vulnarable to withdraw which exceed limit amount.

Proof of Concept

in withdrawHook there is no requirement for exceed user or global limit just record how much money withdrawed by this way anybody who want to withdraw when global and user limit has finished.When they started a new time period they dont face to any limit about withdraw amount. https://github.com/merteren1234/prepo-typescript-test this is the test which I use. and in the below it shows it is correct.

Recommended Mitigation Steps

In 59-62 and 66-69 lines in github line which ı mentioned to affected code, should be insert requirement like require(_amountBeforeFee<globalWithdrawLimitPerPeriod) and require(_amountBeforeFee<userWithdrawLimitPerPeriod)