Silvermist - Zero-amount deposits will cause an underflow on withdrawal

[sherlock-admin2]

Silvermist

High

Zero-amount deposits will cause an underflow on withdrawal

Summary

Users can make zero-amount deposits, leading to an arithmetic underflow in the withdrawal logic. When a withdrawal is attempted, the function calculates amount_to_transfer by subtracting withdraw_params.fee from withdraw_params.token_amount. With token_amount set to zero, this results in a negative outcome, which causes an underflow.

Root Cause

There is no validation to ensure that the deposit amount is greater than zero, nor is there a check to prevent withdrawal if the amount is insufficient to cover fees, which can cause an underflow. When the amount_to_transfer is calculated, withdraw_params.token_amount (which may be zero) has withdraw_params.fee subtracted from it. This subtraction leads to an underflow if token_amount is zero.

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

No response

Impact

Due to the underflow, an attacker can get more tokens than they deposited.

PoC

No response

Mitigation

No response