prePO contest - wuwe1's results

Lines of code

https://github.com/code-423n4/2022-03-prepo/blob/main/contracts/core/Collateral.sol#L61

Vulnerability details

Proof of Concept

https://github.com/code-423n4/2022-03-prepo/blob/main/contracts/core/Collateral.sol#L61

uint256 _amountToDeposit = _baseToken.balanceOf(address(this));

Amount to deposit is balance of the contract.

1. Alice --- transfer 100 usdc ---> Collateral
2. bob --- deposit(0) ---> Collateral

Recommended Mitigation Steps

Consider use calldata amount instead of _baseToken.balanceOf(address(this))

function deposit(uint256 _amount)
    external
    override
    nonReentrant
    returns (uint256)
{
    require(_depositsAllowed, "Deposits not allowed");
    _baseToken.safeTransferFrom(msg.sender, address(this), _amount);
    // Record deposit before fee is taken
    if (address(_depositHook) != address(0)) {
        _depositHook.hook(msg.sender, _amount, _amount);
    }
    /**
     * Add 1 to avoid rounding to zero, only process deposit if user is
     * depositing an amount large enough to pay a fee.
     */
    uint256 _fee = (_amount * _mintingFee) / FEE_DENOMINATOR + 1;
    require(_amount > _fee, "Deposit amount too small");
    _baseToken.safeTransfer(_treasury, _fee);
    _amount -= _fee;

    uint256 _valueBefore = _strategyController.totalValue();
    _baseToken.approve(address(_strategyController), _amount);
    _strategyController.deposit(_amount);
    uint256 _valueAfter = _strategyController.totalValue();
    _amount = _valueAfter - _valueBefore;

    uint256 _shares = 0;
    if (totalSupply() == 0) {
        _shares = _amount;
    } else {
        /**
         * # of shares owed = amount deposited / cost per share, cost per
         * share = total supply / total value.
         */
        _shares = (_amount * totalSupply()) / (_valueBefore);
    }
    _mint(msg.sender, _shares);
    return _shares;
}