Submitted by jsonDoge, also found by 0x41head, 0xAsen, 0xastronatey, 0xbrett8571, 0xd4ps, 0xgh0stcybers3c, 0xGondar, 0xLeveler, 0xlucky, 0xTonraq, 4B, Abhan, agadzhalov, anchabadze, arman, arnie, aster, Benterkiii, boredpukar, Bz, ChainSentry, ChainSentry, ChainSentry, Coldless, crmx_lom, Daniel_eth, Daniel_eth, Daniel526, Daniel526, DemoreX, dobrevaleri, eldar_m10v, ewwrekt, hjo, IceBear, Illoy-Scizceneghposter, Ishenxx, Ishenxx, Ishenxx, ITCruiser, jkk812812, KannAudits, KannAudits, kn0t, leegh, MSK, Mylifechangefast_eth, Mylifechangefast_eth, natachi, peanuts, phoenixV110, REKCAH, safie, saikumar279, Saurabh_Singh, shaflow2, silver_eth, sohrabhind, sohrabhind, Striking_Lions, Takarez, teoslaf, tpiliposian, UzeyirCh, w33kEd, wahedtalash77, web3km, web3km, yaioxy, zhanmingjing, zraxx, and ZZhelev
https://github.com/code-423n4/2025-02-thorwallet/blob/98d7e936518ebd80e2029d782ffe763a3732a792/contracts/MergeTgt.sol#L81
MergeTgt has hardcoded amounts of TGTTOEXCHANGE and TITNARB. Their ratio is used for rate calculation and TITNARB amount of TITN is deposited to be claimed.
The contract has no actual logic which would limit the deposited Tgt to MergeTgt. This means if this amount is crossed, any last claimers will not be able to do so or retrieve their Tgt back.
This same vulnerability also introduces an overflow in withdrawRemainingTitn. Since TGT is allowed to exceed the hardcoded value, the claimable TINT exceeds the actual mergeTgt contract TITN balance.
And this line overflows, as remainingTitnAfter1Year becomes less than the initialTotalClaimable.
Likelihood: Medium - The total Tgt of all users has to exceed TGTTOEXCHANGE. According to blockchain explorers, ARB has 447,034,102 and ETH has 897,791,792, which is more than double the TGTTOEXCHANGE of 579,000,000, so quite likely.
Impact: High - loss of user funds and breaking contract logic (revert on claim).
A modified MNrgeTgt.test.ts. Main modifications:
Steps in tests:
Test final claim fails with:
Limit the total deposits to TGTTOEXCHANGE by tracking how much TGT has already been deposited.
MergeTgt.sol
Or 
the same idea, but limit the totalTitnClaimable by TITN_ARB value. This will likely be more efficient, as the rate tgt/titn is dynamic.
cacaomatt (THORWallet) confirmed and commented:
THORWallet mitigated:.
Status: Mitigation confirmed. Full details in reports from shaflow2, web3km, and kn0t.
