minAmount is ignored when amount is zero during rage quit

[c4-submissions]

Lines of code

https://github.com/code-423n4/2023-10-party/blob/053fb9345b0739b3c26d12e1eae1eefbfd70b223/contracts/party/PartyGovernanceNFT.sol#L426-L432

Vulnerability details

During rage quit the rage quitter supplies a list of tokens to take a fair share of and the expected minimum amount out. If the share of any of the tokens is less than the minimum then the function reverts.
However, if the share is zero then the minimum amount is ignored and the function doesn't revert.
A user might be rage quitting during a proposal execution that empties out a token (e.g. the party is purchasing an NFT) expecting the function to revert if the proposal was executed already. But in that case the function wouldn't revert and the user would end up losing a part of their share.

Impact

Rage quitter might get less than the fair share they deserve

Proof of Concept

In the following code snippet it can be seen that the check is done only if amount > 0

                if (amount > 0) {
                    uint256 minAmount = minWithdrawAmounts[i];

                    // Check amount is at least minimum.
                    if (amount < minAmount) {
                        revert BelowMinWithdrawAmountError(amount, minAmount);
                    }

Recommended Mitigation Steps

In case that amount is zero - revert if the minimum amount is greater than zero

Assessed type

Other

[ydspa]

QA: L

[c4-pre-sort]

ydspa marked the issue as insufficient quality report

[c4-pre-sort]

ydspa marked the issue as primary issue

[c4-judge]

gzeon-c4 changed the severity to 2 (Med Risk)

[gzeon-c4]

Potential value leak, no reason to ignore specified values.
Judging as Med instead of High because while a function of the protocol is impacted, asset is not lost considering the user should call ragequit before the proposal that transfer out the token is executed.

[c4-judge]

gzeon-c4 marked the issue as selected for report

[c4-judge]

gzeon-c4 marked the issue as satisfactory

[c4-judge]

gzeon-c4 marked the issue as not selected for report

[c4-judge]

gzeon-c4 marked issue #237 as primary and marked this issue as a duplicate of 237