s1ce - calculateMaxAllocation computes max allocation incorrectly

[sherlock-admin4]

s1ce

high

calculateMaxAllocation computes max allocation incorrectly

Summary

calculateMaxAllocation takes the maximum of userMaxAllc and maxAllocation in order to compute the max allocation. However, it should be taking the minimum.

Vulnerability Detail

Here is the relevant code:

    function calculateMaxAllocation(address _sender) public returns (uint256) {
        uint256 userMaxAllc = _maxTierAllc(_sender);

        if (userMaxAllc > maxAllocation) {
            return userMaxAllc;
        } else {
            return maxAllocation;
        }
    }

The way that this is currently written, even if the user has very little or even no allocation, they will get up to maxAllocation. This is clearly not intended protocol design and ends up allowing users to take way more allocation than intended, defeating the purpose of a private token sale. Users can also sybil with this to take extreme amounts more allocation than intended.

Impact

Users can take way more allocation than intended

Code Snippet

https://github.com/sherlock-audit/2024-03-zap-protocol/blob/main/zap-contracts-labs/contracts/TokenSale.sol#L259

Tool used

Manual Review

Recommendation

Take min instead of max

Duplicate of #152