{"componentChunkName":"component---node-modules-rocketseat-gatsby-theme-docs-core-src-templates-docs-query-js","path":"/manual-review/GatedMintEscrow-GME","result":{"data":{"mdx":{"id":"7695cc19-4a61-51c1-81e4-4976ca660d68","excerpt":"GME-01M: Inexistent Strategy Integration Type Severity Location Standard Conformity GatedMintEscrow.sol:L146 ,  L177 ,  L231 ,  L256 Description: The…","fields":{"slug":"/manual-review/GatedMintEscrow-GME/"},"frontmatter":{"title":"GatedMintEscrow Manual Review Findings","description":"Contains all the findings that relate to manual review on the contract codebase","image":null,"disableTableOfContents":null},"body":"var _excluded = [\"components\"];\n\nfunction _extends() { _extends = Object.assign || function (target) { for (var i = 1; i < arguments.length; i++) { var source = arguments[i]; for (var key in source) { if (Object.prototype.hasOwnProperty.call(source, key)) { target[key] = source[key]; } } } return target; }; return _extends.apply(this, arguments); }\n\nfunction _objectWithoutProperties(source, excluded) { if (source == null) return {}; var target = _objectWithoutPropertiesLoose(source, excluded); var key, i; if (Object.getOwnPropertySymbols) { var sourceSymbolKeys = Object.getOwnPropertySymbols(source); for (i = 0; i < sourceSymbolKeys.length; i++) { key = sourceSymbolKeys[i]; if (excluded.indexOf(key) >= 0) continue; if (!Object.prototype.propertyIsEnumerable.call(source, key)) continue; target[key] = source[key]; } } return target; }\n\nfunction _objectWithoutPropertiesLoose(source, excluded) { if (source == null) return {}; var target = {}; var sourceKeys = Object.keys(source); var key, i; for (i = 0; i < sourceKeys.length; i++) { key = sourceKeys[i]; if (excluded.indexOf(key) >= 0) continue; target[key] = source[key]; } return target; }\n\n/* @jsxRuntime classic */\n\n/* @jsx mdx */\nvar _frontmatter = {\n  \"title\": \"GatedMintEscrow Manual Review Findings\",\n  \"description\": \"Contains all the findings that relate to manual review on the contract codebase\"\n};\nvar layoutProps = {\n  _frontmatter: _frontmatter\n};\nvar MDXLayout = \"wrapper\";\nreturn function MDXContent(_ref) {\n  var components = _ref.components,\n      props = _objectWithoutProperties(_ref, _excluded);\n\n  return mdx(MDXLayout, _extends({}, layoutProps, props, {\n    components: components,\n    mdxType: \"MDXLayout\"\n  }), mdx(\"h2\", {\n    \"id\": \"span-idgme-01mgme-01m-inexistent-strategy-integrationspan\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h2\",\n    \"href\": \"#span-idgme-01mgme-01m-inexistent-strategy-integrationspan\",\n    \"aria-label\": \"span idgme 01mgme 01m inexistent strategy integrationspan permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), mdx(\"span\", {\n    id: \"GME-01M\"\n  }, \"GME-01M: Inexistent Strategy Integration\")), mdx(\"table\", null, mdx(\"thead\", {\n    parentName: \"table\"\n  }, mdx(\"tr\", {\n    parentName: \"thead\"\n  }, mdx(\"th\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Type\"), mdx(\"th\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Severity\"), mdx(\"th\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Location\"))), mdx(\"tbody\", {\n    parentName: \"table\"\n  }, mdx(\"tr\", {\n    parentName: \"tbody\"\n  }, mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"/reports/sova-network-fountfi-protocol-684adfa36579f5001821a219/appendix/finding-types#standard-conformity\"\n  }, \"Standard Conformity\")), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"img\", {\n    parentName: \"td\",\n    \"className\": \"o-severity o-informational\",\n    \"src\": \"https://omniscia.io/report-assets/informational.png\"\n  })), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"https://github.com/SovaNetwork/fountfi/blob/fca2fe922e699e8762410f40e249961b53c3bf92/src/strategy/GatedMintEscrow.sol#L146\"\n  }, \"GatedMintEscrow.sol:L146\"), \", \", mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"https://github.com/SovaNetwork/fountfi/blob/fca2fe922e699e8762410f40e249961b53c3bf92/src/strategy/GatedMintEscrow.sol#L177\"\n  }, \"L177\"), \", \", mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"https://github.com/SovaNetwork/fountfi/blob/fca2fe922e699e8762410f40e249961b53c3bf92/src/strategy/GatedMintEscrow.sol#L231\"\n  }, \"L231\"), \", \", mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"https://github.com/SovaNetwork/fountfi/blob/fca2fe922e699e8762410f40e249961b53c3bf92/src/strategy/GatedMintEscrow.sol#L256\"\n  }, \"L256\"))))), mdx(\"h3\", {\n    \"id\": \"description\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#description\",\n    \"aria-label\": \"description permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Description:\"), mdx(\"p\", null, \"The \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"GatedMintEscrow\"), \" contract is meant to be integrated by a strategy, however, no strategy presently integrates it.\"), mdx(\"p\", null, \"Specifically, all deposit acceptance and refund flows rely on a \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"strategy\"), \" invoking it yet no contract in scope invokes those functions. There are several hidden assumptions and potential vulnerabilities that might arise from how strategies integrate with the \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"GatedMintEscrow\"), \" contract which cannot be surfaced without a reference implementation.\"), mdx(\"h3\", {\n    \"id\": \"example\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#example\",\n    \"aria-label\": \"example permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Example:\"), mdx(\"pre\", null, mdx(\"code\", {\n    parentName: \"pre\",\n    \"className\": \"language-sol\",\n    \"metastring\": \"title=src/strategy/GatedMintEscrow.sol highlight={3} lineNumbers=true lineOffset=228\",\n    \"title\": \"src/strategy/GatedMintEscrow.sol\",\n    \"highlight\": \"{3}\",\n    \"lineNumbers\": \"true\",\n    \"lineOffset\": \"228\"\n  }, \"function refundDeposit(bytes32 depositId) external {\\n    // Only strategy can call this function\\n    if (msg.sender != strategy) revert Unauthorized();\\n\")), mdx(\"h3\", {\n    \"id\": \"recommendation\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#recommendation\",\n    \"aria-label\": \"recommendation permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Recommendation:\"), mdx(\"p\", null, \"We advise a reference implementation of a \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"strategy\"), \" to be introduced to the audit scope so as to properly validate the \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"GatedMintEscrow\"), \" contract's proper operation.\"), mdx(\"p\", null, \"As an example, a smart contract relying on batch acceptance or refund flows might be susceptible to an irrecoverable Denial-of-Service attack if a user reclaims their deposit directly on the \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"GatedMintEscrow\"), \" contract.\"), mdx(\"h3\", {\n    \"id\": \"alleviation-e4d6885477438291b0d3ca477fab7e088522967b\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#alleviation-e4d6885477438291b0d3ca477fab7e088522967b\",\n    \"aria-label\": \"alleviation e4d6885477438291b0d3ca477fab7e088522967b permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Alleviation (e4d6885477438291b0d3ca477fab7e088522967b):\"), mdx(\"p\", null, \"The Sova Network team evaluated this exhibit and clarified that the strategy is meant to be interacted with via manually crafted payloads through the \", mdx(\"a\", {\n    parentName: \"p\",\n    \"href\": \"https://github.com/SovaNetwork/fountfi/blob/e4d6885477438291b0d3ca477fab7e088522967b/src/strategy/BasicStrategy.sol#L159-L167\"\n  }, mdx(\"inlineCode\", {\n    parentName: \"a\"\n  }, \"BasicStrategy::call\")), \" function.\"), mdx(\"p\", null, \"As such interactions are impossible to validate reliably on-chain and involve off-chain processes, we consider all integrations to be validated atomically and strongly recommend the off-chain processes to be closely evaluated by the Sova Network team for any potential issues.\"), mdx(ViewDiffButton, {\n    repoUrl: \"https://github.com/SovaNetwork/fountfi\",\n    mainHash: \"fca2fe922e699e8762410f40e249961b53c3bf92\",\n    fixHash: \"e4d6885477438291b0d3ca477fab7e088522967b\",\n    gitHubIssue: \"4\",\n    mdxType: \"ViewDiffButton\"\n  }), mdx(\"h2\", {\n    \"id\": \"span-idgme-02mgme-02m-insecure-type-castingspan\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h2\",\n    \"href\": \"#span-idgme-02mgme-02m-insecure-type-castingspan\",\n    \"aria-label\": \"span idgme 02mgme 02m insecure type castingspan permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), mdx(\"span\", {\n    id: \"GME-02M\"\n  }, \"GME-02M: Insecure Type Casting\")), mdx(\"table\", null, mdx(\"thead\", {\n    parentName: \"table\"\n  }, mdx(\"tr\", {\n    parentName: \"thead\"\n  }, mdx(\"th\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Type\"), mdx(\"th\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Severity\"), mdx(\"th\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Location\"))), mdx(\"tbody\", {\n    parentName: \"table\"\n  }, mdx(\"tr\", {\n    parentName: \"tbody\"\n  }, mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"/reports/sova-network-fountfi-protocol-684adfa36579f5001821a219/appendix/finding-types#mathematical-operations\"\n  }, \"Mathematical Operations\")), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"img\", {\n    parentName: \"td\",\n    \"className\": \"o-severity o-minor\",\n    \"src\": \"https://omniscia.io/report-assets/minor.png\"\n  })), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"https://github.com/SovaNetwork/fountfi/blob/fca2fe922e699e8762410f40e249961b53c3bf92/src/strategy/GatedMintEscrow.sol#L128\"\n  }, \"GatedMintEscrow.sol:L128\"))))), mdx(\"h3\", {\n    \"id\": \"description-1\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#description-1\",\n    \"aria-label\": \"description 1 permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Description:\"), mdx(\"p\", null, \"The \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"expirationTime\"), \" variable is downcast from a \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"uint256\"), \" data type to the \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"uint96\"), \" data type without any bound checking, permitting casting overflows to occur.\"), mdx(\"h3\", {\n    \"id\": \"impact\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#impact\",\n    \"aria-label\": \"impact permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Impact:\"), mdx(\"p\", null, \"Although unlikely, a value that exceeds \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"type(uint96).max\"), \" as an \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"expirationTime\"), \" will result in an underflow without yielding an error which we consider incorrect.\"), mdx(\"h3\", {\n    \"id\": \"example-1\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#example-1\",\n    \"aria-label\": \"example 1 permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Example:\"), mdx(\"pre\", null, mdx(\"code\", {\n    parentName: \"pre\",\n    \"className\": \"language-sol\",\n    \"metastring\": \"title=src/strategy/GatedMintEscrow.sol highlight={16} lineNumbers=true lineOffset=112\",\n    \"title\": \"src/strategy/GatedMintEscrow.sol\",\n    \"highlight\": \"{16}\",\n    \"lineNumbers\": \"true\",\n    \"lineOffset\": \"112\"\n  }, \"function handleDepositReceived(\\n    bytes32 depositId,\\n    address depositor,\\n    address recipient,\\n    uint256 amount,\\n    uint256 expirationTime\\n) external {\\n    // Only GatedMintRWA token can call this function\\n    if (msg.sender != token) revert Unauthorized();\\n\\n    // Store the deposit data\\n    pendingDeposits[depositId] = PendingDeposit({\\n        depositor: depositor,\\n        recipient: recipient,\\n        assetAmount: amount,\\n        expirationTime: uint96(expirationTime),\\n        state: DepositState.PENDING,\\n        atRound: currentRound\\n    });\\n\\n    // Update accounting\\n    totalPendingAssets += amount;\\n    userPendingAssets[depositor] += amount;\\n\\n    emit DepositReceived(depositId, depositor, recipient, amount, expirationTime);\\n}\\n\")), mdx(\"h3\", {\n    \"id\": \"recommendation-1\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#recommendation-1\",\n    \"aria-label\": \"recommendation 1 permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Recommendation:\"), mdx(\"p\", null, \"We advise the code to ensure that the \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"expirationTime\"), \" fits within the \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"uint96\"), \" data type, preventing potential manipulations of the recorded expiration time of a deposit.\"), mdx(\"h3\", {\n    \"id\": \"alleviation-e4d6885477438291b0d3ca477fab7e088522967b-1\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#alleviation-e4d6885477438291b0d3ca477fab7e088522967b-1\",\n    \"aria-label\": \"alleviation e4d6885477438291b0d3ca477fab7e088522967b 1 permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Alleviation (e4d6885477438291b0d3ca477fab7e088522967b):\"), mdx(\"p\", null, \"The Sova Network team evaluated this exhibit and opted to acknowledge it as an aberrant value would solely arise from a misconfiguration of the \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"GatedMintRWA\"), \" contract, rendering this exhibit acknowledged.\"), mdx(\"h2\", {\n    \"id\": \"span-idgme-03mgme-03m-inexistent-slippage-protectionspan\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h2\",\n    \"href\": \"#span-idgme-03mgme-03m-inexistent-slippage-protectionspan\",\n    \"aria-label\": \"span idgme 03mgme 03m inexistent slippage protectionspan permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), mdx(\"span\", {\n    id: \"GME-03M\"\n  }, \"GME-03M: Inexistent Slippage Protection\")), mdx(\"table\", null, mdx(\"thead\", {\n    parentName: \"table\"\n  }, mdx(\"tr\", {\n    parentName: \"thead\"\n  }, mdx(\"th\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Type\"), mdx(\"th\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Severity\"), mdx(\"th\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, \"Location\"))), mdx(\"tbody\", {\n    parentName: \"table\"\n  }, mdx(\"tr\", {\n    parentName: \"tbody\"\n  }, mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"/reports/sova-network-fountfi-protocol-684adfa36579f5001821a219/appendix/finding-types#logical-fault\"\n  }, \"Logical Fault\")), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"img\", {\n    parentName: \"td\",\n    \"className\": \"o-severity o-medium\",\n    \"src\": \"https://omniscia.io/report-assets/medium.png\"\n  })), mdx(\"td\", {\n    parentName: \"tr\",\n    \"align\": null\n  }, mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"https://github.com/SovaNetwork/fountfi/blob/fca2fe922e699e8762410f40e249961b53c3bf92/src/strategy/GatedMintEscrow.sol#L113-L119\"\n  }, \"GatedMintEscrow.sol:L113-L119\"), \", \", mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"https://github.com/SovaNetwork/fountfi/blob/fca2fe922e699e8762410f40e249961b53c3bf92/src/strategy/GatedMintEscrow.sol#L144-L169\"\n  }, \"L144-L169\"), \", \", mdx(\"a\", {\n    parentName: \"td\",\n    \"href\": \"https://github.com/SovaNetwork/fountfi/blob/fca2fe922e699e8762410f40e249961b53c3bf92/src/strategy/GatedMintEscrow.sol#L175-L223\"\n  }, \"L175-L223\"))))), mdx(\"h3\", {\n    \"id\": \"description-2\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#description-2\",\n    \"aria-label\": \"description 2 permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Description:\"), mdx(\"p\", null, \"The \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"GatedMintEscrow\"), \" contract meant to be interfaced by the \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"GatedMintRWA\"), \" contract is supposed to be part of a \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"ReportedStrategy\"), \", effectively one whose evaluation might change through oracle measurements (or other mechanisms).\"), mdx(\"p\", null, \"The present delayed deposit mechanism does not allow the depositors to specify an upper price they are willing to accept (or other control mechanism), effectively rendering their deposits susceptible to arbitrary slippage.\"), mdx(\"h3\", {\n    \"id\": \"impact-1\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#impact-1\",\n    \"aria-label\": \"impact 1 permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Impact:\"), mdx(\"p\", null, \"All delayed deposits are subject to arbitrary fluctuations in the artificial exchange rate of the \", mdx(\"a\", {\n    parentName: \"p\",\n    \"href\": \"https://eips.ethereum.org/EIPS/eip-4626\"\n  }, \"EIP-4626\"), \" vault which relies on a \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"BaseReporter\"), \", such as a \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"PriceOracleReporter\"), \".\"), mdx(\"h3\", {\n    \"id\": \"example-2\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#example-2\",\n    \"aria-label\": \"example 2 permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Example:\"), mdx(\"pre\", null, mdx(\"code\", {\n    parentName: \"pre\",\n    \"className\": \"language-sol\",\n    \"metastring\": \"title=src/strategy/GatedMintEscrow.sol highlight={20,21,22,23,24,25,26,27,62} lineNumbers=true lineOffset=104\",\n    \"title\": \"src/strategy/GatedMintEscrow.sol\",\n    \"highlight\": \"{20,21,22,23,24,25,26,27,62}\",\n    \"lineNumbers\": \"true\",\n    \"lineOffset\": \"104\"\n  }, \"/**\\n * @notice Receive a deposit from the GatedMintRWA token\\n * @param depositId Unique identifier for the deposit\\n * @param depositor Address that initiated the deposit\\n * @param recipient Address that will receive shares if approved\\n * @param amount Amount of assets deposited\\n * @param expirationTime Time after which deposit can be reclaimed\\n */\\nfunction handleDepositReceived(\\n    bytes32 depositId,\\n    address depositor,\\n    address recipient,\\n    uint256 amount,\\n    uint256 expirationTime\\n) external {\\n    // Only GatedMintRWA token can call this function\\n    if (msg.sender != token) revert Unauthorized();\\n\\n    // Store the deposit data\\n    pendingDeposits[depositId] = PendingDeposit({\\n        depositor: depositor,\\n        recipient: recipient,\\n        assetAmount: amount,\\n        expirationTime: uint96(expirationTime),\\n        state: DepositState.PENDING,\\n        atRound: currentRound\\n    });\\n\\n    // Update accounting\\n    totalPendingAssets += amount;\\n    userPendingAssets[depositor] += amount;\\n\\n    emit DepositReceived(depositId, depositor, recipient, amount, expirationTime);\\n}\\n\\n/**\\n * @notice Accept a pending deposit\\n * @param depositId The deposit ID to accept\\n */\\nfunction acceptDeposit(bytes32 depositId) external {\\n    // Only strategy can call this function\\n    if (msg.sender != strategy) revert Unauthorized();\\n\\n    PendingDeposit storage deposit = pendingDeposits[depositId];\\n    if (deposit.depositor == address(0)) revert DepositNotFound();\\n    if (deposit.state != DepositState.PENDING) revert DepositNotPending();\\n\\n    // Mark as accepted\\n    deposit.state = DepositState.ACCEPTED;\\n\\n    // Update accounting\\n    totalPendingAssets -= deposit.assetAmount;\\n    userPendingAssets[deposit.depositor] -= deposit.assetAmount;\\n\\n    // Increment the round number, even for a single deposit\\n    currentRound++;\\n\\n    // Transfer assets to the strategy\\n    SafeTransferLib.safeTransfer(asset, strategy, deposit.assetAmount);\\n\\n    // Tell the GatedMintRWA token to mint shares\\n    GatedMintRWA(token).mintShares(deposit.recipient, deposit.assetAmount);\\n\\n    emit DepositAccepted(depositId, deposit.recipient, deposit.assetAmount);\\n}\\n\")), mdx(\"h3\", {\n    \"id\": \"recommendation-2\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#recommendation-2\",\n    \"aria-label\": \"recommendation 2 permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Recommendation:\"), mdx(\"p\", null, \"We advise the contracts to be refactored so as to permit an upper price bound to be specified that the depositors are willing to accept, effectively converting the \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"GatedMintEscrow\"), \" contract into an oracle-specific or at least price-specific contract module.\"), mdx(\"h3\", {\n    \"id\": \"alleviation-e4d6885477438291b0d3ca477fab7e088522967b-2\",\n    \"style\": {\n      \"position\": \"relative\"\n    }\n  }, mdx(\"a\", {\n    parentName: \"h3\",\n    \"href\": \"#alleviation-e4d6885477438291b0d3ca477fab7e088522967b-2\",\n    \"aria-label\": \"alleviation e4d6885477438291b0d3ca477fab7e088522967b 2 permalink\",\n    \"className\": \"anchor before\"\n  }, mdx(\"svg\", {\n    parentName: \"a\",\n    \"aria-hidden\": \"true\",\n    \"focusable\": \"false\",\n    \"height\": \"16\",\n    \"version\": \"1.1\",\n    \"viewBox\": \"0 0 16 16\",\n    \"width\": \"16\"\n  }, mdx(\"path\", {\n    parentName: \"svg\",\n    \"fillRule\": \"evenodd\",\n    \"d\": \"M4 9h1v1H4c-1.5 0-3-1.69-3-3.5S2.55 3 4 3h4c1.45 0 3 1.69 3 3.5 0 1.41-.91 2.72-2 3.25V8.59c.58-.45 1-1.27 1-2.09C10 5.22 8.98 4 8 4H4c-.98 0-2 1.22-2 2.5S3 9 4 9zm9-3h-1v1h1c1 0 2 1.22 2 2.5S13.98 12 13 12H9c-.98 0-2-1.22-2-2.5 0-.83.42-1.64 1-2.09V6.25c-1.09.53-2 1.84-2 3.25C6 11.31 7.55 13 9 13h4c1.45 0 3-1.69 3-3.5S14.5 6 13 6z\"\n  }))), \"Alleviation (e4d6885477438291b0d3ca477fab7e088522967b):\"), mdx(\"p\", null, \"The Sova Network team evaluated this exhibit and consider the vulnerability to be correct. As such, they have opted to introduce a \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"FIXME\"), \" comment on the \", mdx(\"inlineCode\", {\n    parentName: \"p\"\n  }, \"GatedMintRWA\"), \" contract regarding this issue and to acknowledge the exhibit at this stage.\"), mdx(ViewDiffButton, {\n    repoUrl: \"https://github.com/SovaNetwork/fountfi\",\n    mainHash: \"fca2fe922e699e8762410f40e249961b53c3bf92\",\n    fixHash: \"e4d6885477438291b0d3ca477fab7e088522967b\",\n    gitHubIssue: \"5\",\n    mdxType: \"ViewDiffButton\"\n  }));\n}\n;\nMDXContent.isMDXComponent = true;","headings":[{"depth":2,"value":"<span id=\"GME-01M\">GME-01M: Inexistent Strategy Integration</span>"},{"depth":3,"value":"Description:"},{"depth":3,"value":"Example:"},{"depth":3,"value":"Recommendation:"},{"depth":3,"value":"Alleviation (e4d6885477438291b0d3ca477fab7e088522967b):"},{"depth":2,"value":"<span id=\"GME-02M\">GME-02M: Insecure Type Casting</span>"},{"depth":3,"value":"Description:"},{"depth":3,"value":"Impact:"},{"depth":3,"value":"Example:"},{"depth":3,"value":"Recommendation:"},{"depth":3,"value":"Alleviation (e4d6885477438291b0d3ca477fab7e088522967b):"},{"depth":2,"value":"<span id=\"GME-03M\">GME-03M: Inexistent Slippage Protection</span>"},{"depth":3,"value":"Description:"},{"depth":3,"value":"Impact:"},{"depth":3,"value":"Example:"},{"depth":3,"value":"Recommendation:"},{"depth":3,"value":"Alleviation (e4d6885477438291b0d3ca477fab7e088522967b):"}]}},"pageContext":{"slug":"/manual-review/GatedMintEscrow-GME/","prev":{"label":"RoleManager.sol (RMR-S)","link":"/static-analysis/RoleManager-RMR"},"next":{"label":"ManagedWithdrawRWA.sol (MWR-M)","link":"/manual-review/ManagedWithdrawRWA-MWR"}}},"staticQueryHashes":["1954253342","2328931024","2501019404","973074209"]}