QA Report

[code423n4]

Lines of code

https://github.com/code-423n4/2022-02-hubble/blob/main/contracts/VUSD.sol#L48
https://github.com/code-423n4/2022-02-hubble/blob/main/contracts/VUSD.sol#L43

Vulnerability details

Impact

In VUSD.sol the mintWithReserve() and withdraw() functions both handle minting and burning of the vusd tokens. Both of these function don't require that the amount passed in is larger than 0 while still emitting an event through the open zepellin erc20 library. Leaving out this check can trick the protocol into thinking that funds were minted or burned when in fact they were not. This is especially important if the protocol will ever be relying on these events to make important decisions in the code.

Proof of Concept

https://github.com/code-423n4/2022-02-hubble/blob/main/contracts/VUSD.sol#L48

https://github.com/code-423n4/2022-02-hubble/blob/main/contracts/VUSD.sol#L43

Tools Used

Manual code review

Recommended Mitigation Steps

add to mintWithReserve() and withdraw() functions in VUSD.sol:
require(amount > 0, "Amount cannot be 0");

[atvanguard]

Duplicate of #119

[moose-code]

Not agreeing its a duplicate of #119 as it doesn't talk about ddos. Making this low.

[JeeberC4]

Since this issue was downgraded to a QA level, and the warden did not submit a separate QA report, we've renamed this one to "QA report" for consistency.
The original title, for the record, was VUSD.sol functions don't check if amount > 0