Aggregated contractPCT's can be > 1 Ether

[code423n4]

Lines of code

https://github.com/code-423n4/2022-12-gogopool/blob/main/contracts/contract/ProtocolDAO.sol#L107

Vulnerability details

Impact

The setClaimingContractPct function allows for aggregated percentages > 1 Ether which will result in a revert within startRewardsCycle

Proof of Concept

Currently, the setClaimingContractPct function nicely checks if the provided decimal for the provided contract is <= 1 Ether. However, it does not check if all three used contracts: ClaimMultisig, ClaimNodeOp and ClaimProtocolDAO have an aggregated value <= 1 Ether. If they are >1 Ether, the function startRewardsCycle will always revert in the following line: https://github.com/code-423n4/2022-12-gogopool/blob/main/contracts/contract/RewardsPool.sol#L175.

Tools Used

VSCode

Recommended Mitigation Steps

Consider checking if all three contracts have an aggregated value <= 1 Ether, if not revert the function.

*This is the first contest i took part, therefore my submissions might not be ideal yet, if there are any questions feel free to contact me directly in discord :-)

[GalloDaSballo]

Invalid

[c4-judge]

GalloDaSballo marked the issue as unsatisfactory:
Invalid

[c4-judge]

Duplicate of #710

[GalloDaSballo]

My mistake, the finding is valid, but because of this check
https://github.com/code-423n4/2022-12-gogopool/blob/aec9928d8bdce8a5a4efe45f54c39d4fc7313731/contracts/contract/RewardsPool.sol#L175-L176

			revert IncorrectRewardsDistribution();

The finding is QA - Low Severity

L