BPZ - Users will experience a DOS when trying to deposit to a LMPVault that has its supplyLimit and walletLimit set to type(uint256).max values

[sherlock-admin2]

BPZ

medium

Users will experience a DOS when trying to deposit to a LMPVault that has its supplyLimit and walletLimit set to type(uint256).max values

Summary

The deposit function of the LMPVault contract asserts that the amount of assets being deposited is not greater than the max deposit for the caller. However, because the _maxMint function will return the type(uint256).max value when both the supplyLimit and walletLimit are set to this value, this assertion will almost always revert when the supply is greater than 0 and totalAssets() / supply > 1 because the type(uint256).max will be provided to the _convertToAssets function as the shares parameter, leading to an over-flow error on the assets calculation.

Vulnerability Detail

The deposit function asserts that the assets parameter is not greater than the caller's max deposit. The maxDeposit function invokes the _maxMint function which will return the type(uint256).max value when both the supplyLimit and walletLimit are set to this value. This will cause the type(uint256).max value to be provided to the _convertToAssets function as the shares parameter. If the supply is then non-zero and totalAssets() / supply > 1, this calculation will almost always result in an over-flow error.

Impact

Users will experience a DOS when attempting to deposit to an LMPVault that has both its supplyLimit and walletLimit set to the type(uint256).max value.

Code Snippet

https://github.com/Tokemak/v2-core-audit-2023-07-14/blob/62445b8ee3365611534c96aef189642b721693bf/src/vault/LMPVault.sol#L337

https://github.com/Tokemak/v2-core-audit-2023-07-14/blob/62445b8ee3365611534c96aef189642b721693bf/src/vault/LMPVault.sol#L324

https://github.com/Tokemak/v2-core-audit-2023-07-14/blob/62445b8ee3365611534c96aef189642b721693bf/src/vault/LMPVault.sol#L936-L938

https://github.com/Tokemak/v2-core-audit-2023-07-14/blob/62445b8ee3365611534c96aef189642b721693bf/src/vault/LMPVault.sol#L315

https://github.com/Tokemak/v2-core-audit-2023-07-14/blob/62445b8ee3365611534c96aef189642b721693bf/src/vault/LMPVault.sol#L597

Tool used

Manual Review

Recommendation

It is recommended to refactor the maxDeposit function to return the type(uint256).max value if the _maxMint function returns this value. This can be implemented by refactoring the maxDeposit function as follows:

    function maxDeposit(address wallet) public view virtual override returns (uint256 maxAssets) {
        // @audit recommended mitigation
        uint256 maxMintAmount = _maxMint(wallet);
        maxAssets = maxMintAmount == type(uint256).max ? maxMintAmount : convertToAssets(maxMintAmount);
    }

Duplicate of #577

[sherlock-admin2]

1 comment(s) were left on this issue during the judging contest.

Trumpero commented:

low, when totalSupplyLimit == perWalletLimit == uint256.max, it's correct that function deposit() is unable to use but the function mint() can be used instead by the users.
Furthermore, when this case happens, the admin can set the limit to another value to mitigate the issue --> No fund are at risk, and temporary DOS