Deposit function does not check for the maxMint amount.

[c4-bot-8]

Lines of code

https://github.com/code-423n4/2024-04-panoptic/blob/833312ebd600665b577fbd9c03ffa0daf250ed24/contracts/CollateralTracker.sol#L417

Vulnerability details

Summary

The deposit function has a check for maxDeposit and reverts if the deposit value is more than type(uint104).max.

function maxDeposit(address) external pure returns (uint256 maxAssets) {
        return type(uint104).max;
    }

function deposit(uint256 assets, address receiver) external returns (uint256 shares) {
        if (assets > type(uint104).max) revert Errors.DepositTooLarge();
        //...
}

But, it does not check the shares to be less than maxMint amount and hence bypasses this check. Theoretically, if the assets are equal to type(uint104).max and if the vault is undercollateralised, then the calculation in convertToShares(type(uint104).max) * DECIMALS) / (DECIMALS + COMMISSION_FEE) could return a value more than the maxMint amount. This is possible in those scenarios where the asset has big number of decimals (README confirms it) and the Vault is severely under-collateralized.

Impact

It is theoretically possible for the deposit amount to mint shares more than the maxMint amount

Tools Used

Manual rewiew

Recommended Mitigation Steps

Include the maxMint check in the deposit function to prevent this problem.

Assessed type

ERC4626

[c4-judge]

Picodes marked the issue as duplicate of #553

[c4-judge]

Picodes marked the issue as satisfactory

[c4-judge]

Picodes changed the severity to QA (Quality Assurance)