Divide by 0 error as totalSupply() can be equal to 0

[code423n4]

Handle

Dravee

Vulnerability details

Impact

Divide by 0 panic error.

Proof of Concept

The check exists in the _mint() function to prevent a divide by 0 error:

File: sNOTE.sol
348:         if (_totalSupply == 0) {

However, sNote.sol:getPoolTokenShare() doesn't check for totalSupply() != 0:

File: sNOTE.sol
257:     function getPoolTokenShare(uint256 sNOTEAmount) public view returns (uint256 bptClaim) {
258:         uint256 bptBalance = BALANCER_POOL_TOKEN.balanceOf(address(this));
259:         // BPT and sNOTE are both in 18 decimal precision so no conversion required
260:         return (bptBalance * sNOTEAmount) / totalSupply();
261:     }

Neither does getVotingPower():

File: sNOTE.sol
292:         return (noteAmount * sNOTEAmount) / totalSupply();

Tools Used

VS Code

Recommended Mitigation Steps

Check that totalSupply() != 0 before division

[jeffywu]

Duplicate #170

[pauliax]

#170