Transferring 0 amounts of non-existent tokens when all liquidity is removed results in unexpected behaviors

[c4-bot-9]

Lines of code

https://github.com/code-423n4/2023-11-panoptic/blob/aa86461c9d6e60ef75ed5a1fe36a748b952c8666/contracts/tokens/ERC1155Minimal.sol#L90-L118
https://github.com/code-423n4/2023-11-panoptic/blob/aa86461c9d6e60ef75ed5a1fe36a748b952c8666/contracts/SemiFungiblePositionManager.sol#L586-L630

Vulnerability details

Impact

Currently, ERC1155Minimal.sol allows 0 transfers, which means that tokens that were not minted can be "transferred". Normally this wouldn't be a problem, but in registerTokenTransfer a 0 transfer can actually transfer non-zero liquidity due to the possibility of different token ids sharing the same liquidity position key.

This could lead to unexpected scenarios in which liquidity gets trapped or removedLiquidity underflows, affecting the calculation of premiums and fees.

Proof of Concept

Here is a simple test example that exploits the mentioned behavior to reach an unexpected state https://gist.github.com/fnanni-0/8ebb660b1d4ef518a409e2b82b293113.
Running forge test -vv --match-test test_Success_ZeroTransfers outputs a step by step explanation of what is happening:

Alice mints 1010 of token C (short put, i.e. adds liquidity to AMM).

  Minted positionSize: 1010
  Alice balance token C: 1010
  Added liquidity: 50
  Removed liquidity: 0
  

Alice mints 1010 of token A (long put, i.e. removes all liquidity from AMM). Token A and Token C have the same position key.

  Minted positionSize: 1010
  Alice balance token A: 1010
  Added liquidity: 0
  Removed liquidity: 50
  

Zero transfer of non-existent token B to Bob. Alice is left with active positions (1010 of token C and 1010 of token A) but liquidity is now empty.

  Alice balance token C: 1010
  Alice balance token B: 0
  Alice balance token A: 1010
  Bob balance token C: 0
  Bob balance token B: 0
  Bob balance token A: 0
  Added liquidity: 0
  Removed liquidity: 0
  Bob's added liquidity: 0
  Bob's removed liquidity: 50
  

Alice burns 210 of token A --> removed liquidity underflows.

  Alice balance token A: 800
  Alice balance token C: 1010
  Added liquidity: 10
  Removed liquidity: 340282366920938463463374607431768211446

Tools Used

Code inspection.

Recommended Mitigation Steps

Block transfers of non-existent tokens (i.e. block transfers with zero amounts).

Assessed type

Token-Transfer

[dyedm1]

dup #256

[c4-sponsor]

dyedm1 (sponsor) confirmed

[c4-judge]

Picodes marked the issue as duplicate of #256

[c4-judge]

Picodes marked the issue as satisfactory