theFirstElder - User can purchase above maximuim allocation

[sherlock-admin3]

theFirstElder

medium

User can purchase above maximuim allocation

Summary

Users can purchase more than the maximum allocation allowed by the contract.

Vulnerability Detail

Due to incorrect contract implementation, users can exceed the maximum allocation limit.

Impact

Allowing users to purchase beyond the maximum allocation violates the contract's maximum deposit invariant.

Code Snippet

https://github.com/sherlock-audit/2024-03-zap-protocol/blob/main/zap-contracts-labs/contracts/TokenSale.sol#L262

Tool used

Manual Review

Recommendation

// @audit incorrect calculation.... maxAll1c > max allocation should return
function calculateMaxAllocation(address _sender) public returns (uint256) {
    uint256 userMaxAllc = _maxTierAllc(_sender);

    if (userMaxAllc > maxAllocation) {
-        return userMaxAllc;
+        return maxAllocation;
    } else {
-         return maxAllocation;
+        return userMaxAllc;
    }
}