Skip to content

Latest commit

 

History

History
41 lines (23 loc) · 1.34 KB

016.md

File metadata and controls

41 lines (23 loc) · 1.34 KB

Low Tangerine Cod

Medium

strikeprice doesn't align with strikePercent

Summary

Users can purchase options at a lower cost because the strike price is not restricted.

Root Cause

User can set strike price to any value, there is no validation for input params. It is not tied to strikePrecent which it should as well

        // Update the borrower details for this index
       depositDetail.normalizedAmount = uint128(normalizedAmount);
       depositDetail.strikePrice = params.strikePrice * uint128(params.depositingAmount);

Blockchian/contracts/lib/BorrowLib.sol#L754

if user set strike price to lower than current eth price than his funds will be stuck due to this line https://github.com/sherlock-audit/2024-11-autonomint/blob/main/Blockchain/Blockchian/contracts/lib/BorrowLib.sol#L489

Internal pre-conditions

External pre-conditions

Attack Path

set percent to max value - TWENTY_FIVE, but strike price to current eth that is appropriate for five percent

Impact

since strikePrice is not tied to strike percent users will be able to buy options for less than suppose to and protocol will receive less funds

Mitigation

Align strike price and Percentage in calculateOptionPrice