Basket might be unusable after initialization due to _initialSupply = 0

[code423n4]

Handle

kenzo

Vulnerability details

A basket is not usable if totalSupply = 0.
When initializing a basket, the initial supply is passed as parameter, but the contract does not verify that that parameter is bigger than 0.

Impact

A basket may be unusable after deployment.

Proof of Concept

A basket should never have totalSupply = 0, as joinPool divides by totalSupply: (Code ref)

uint256 tokenAmount = balance(address(token)).mul(_amount.add(feeAmount)).div(totalSupply);

When the basket's ERC20 facet is initialized, it does not check whether the initialSupply parameter is bigger than 0. The mint function will also not revert.

So, the basket can be deployed with initialSupply = 0 and be unusable.

Note: it is not a part of the audit, but PieFactoryContract also does not check initialSupply.

Recommended Mitigation Steps

Add a check that requires initialSupply > 0.

[0xleastwood]

I consider this a useful check, but it should be made low.