libratus - Inconsistent calcuation of token address limit

[github-actions]

libratus

medium

Inconsistent calcuation of token address limit

Summary

Token address limit depends on the order in which tokens are sent to the bounty. If whitelisted tokens are added first, non-whitelisted will fail.

Vulnerability Detail

It should be possible to fund bounty with non-whitelisted tokens. However, this may fail if whitelisted tokens are deposited first.

Function tokenAddressLimitReached gets the number of token addresses deposited to the bounty. This number, however, contains both whitelisted and non-whitelisted tokens. If the number of deposited whitelisted tokens reaches TOKEN_ADDRESS_LIMIT, it will not be possible to add non-whitelisted tokens to the bounty.

Impact

Users may deposit some whitelisted tokens and then realize that non-whitelisted can't be added. The ones they deposited are now stuck until expiry.

Code Snippet

https://github.com/sherlock-audit/2023-02-openq/blob/main/contracts/DepositManager/Implementations/DepositManagerV1.sol#L207-L217

Tool used

Manual Review

Recommendation

Only check for a number of non-whitelisted tokens deposited to the bounty when enforcing token address limit

Duplicate of #530