No max for defaultIncentive

[code423n4]

Handle

gpersoon

Vulnerability details

Impact

The function setDefaultIncentive of StabilizerNode.sol doesn't check for a maximum value of _incentive.
If _incentive would be very large, then defaultIncentive would be very large and the function _replenishLiquidityExtension() would mint a large amount of malt.

The function setDefaultIncentive() can only be called by an admin, but a mistake could be made.
Also if an admin would want to do a rugpull, this would be an ideal place to do it.

Proof of Concept

https://github.com/code-423n4/2021-11-malt/blob/d3f6a57ba6694b47389b16d9d0a36a956c5e6a94/src/contracts/StabilizerNode.sol#L402-L411

function setDefaultIncentive(uint256 _incentive) external
..
    require(_incentive > 0, "No negative incentive");
    defaultIncentive = _incentive;

https://github.com/code-423n4/2021-11-malt/blob/d3f6a57ba6694b47389b16d9d0a36a956c5e6a94/src/contracts/StabilizerNode.sol#L344

function _replenishLiquidityExtension(uint256 rewards) internal returns (uint256 remaining) {
...
    malt.mint(msg.sender, defaultIncentive*10**18);

Tools Used

Recommended Mitigation Steps

Check for a reasonable maximum value in setDefaultIncentive()

[0xScotch]

#190

[GalloDaSballo]

Duplicate of #190

[GalloDaSballo]

While the finding is valid, because this is a duplicate from the same warden, am marking as invalid