Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

User might claim less Circle token than expected #108

Open
hats-bug-reporter bot opened this issue Sep 16, 2024 · 0 comments
Open

User might claim less Circle token than expected #108

hats-bug-reporter bot opened this issue Sep 16, 2024 · 0 comments
Labels
bug Something isn't working duplicate This issue or pull request already exists invalid This doesn't seem right

Comments

@hats-bug-reporter
Copy link

Github username: --
Twitter username: --
Submission hash (on-chain): 0x0bf0da4bc3b2d481be3ca1f4f021cf4e4c1baeb1f9af6d2e2c912c981c7fc7e6
Severity: medium

Description:
Description\

  1. At timestamp T0, when registering a user by Hub.registerHuman, a human can register by someone inviting
  2. Suppose the _human is also registerred in HubV1 contract, but not stopped, in such case, in mintTime.mintV1Status in Hub.sol#L981 will be address of the Circles contract(not CIRCLES_STOPPED_V1).
  3. After some time, _human calls HubV1.stop to stop the Circle contract for HubV1
  4. At timestamp T1, when Hub._checkHumanV1CirclesStatus is called by Hub.personalMint or Hub.calculateIssuanceWithCheck, in Hub.sol#L1068, because the mintTimes[_human].mintV1Status is not CIRCLES_STOPPED_V1, _updateMintV1Status will be called,

Attack Scenario
As described above, if _human doesn't call HubV1.stop to stop the Circle contract for HubV1 in step3, he will get Circle between timestamp T1 and T0.
But if he calls HubV1.stop, he won't get any Circle

@hats-bug-reporter hats-bug-reporter bot added the bug Something isn't working label Sep 16, 2024
@benjaminbollen benjaminbollen added duplicate This issue or pull request already exists invalid This doesn't seem right labels Sep 16, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working duplicate This issue or pull request already exists invalid This doesn't seem right
Projects
None yet
Development

No branches or pull requests

1 participant