setUnderlyingTokenPercent should check percentages

[code423n4]

Handle

gpersoon

Vulnerability details

Impact

The function setUnderlyingTokenPercent doesn't check that the sum of all the percentages is 100%.
This way the percentages could be accidentally set up the wrong way, with unpredictable results.

Note: the function can only be called by controller or the owner so the likely hood of mistakes is pretty low.

Proof of Concept

//https://github.com/code-423n4/2021-06-gro/blob/main/contracts/insurance/Insurance.sol#L100
function setUnderlyingTokenPercent(uint256 coinIndex, uint256 percent) external override onlyValidIndex(coinIndex) {
require(msg.sender == controller || msg.sender == owner(), "setUnderlyingTokenPercent: !authorized");
underlyingTokensPercents[coinIndex] = percent;
emit LogNewTargetAllocation(coinIndex, percent);
}

Tools Used

Recommended Mitigation Steps

Change setUnderlyingTokenPercent to set the percentages for all the coins at the same time.
And check that the sum of the percentages is 100%

[flabble-gro]

Duplicate of #100