Submitted by IllIllI
If an index has any inactive assets with the role SKIPPED_ASSET_ROLE, a user can repeatedly deposit and withdraw assets, always getting the skipped asset without having to deposit any
During minting, any asset that has the skipped role is excluded from the checks of assets deposited:
File: contracts/IndexLogic.sol (lines 60-70)
During burning, however, theres a bug that only skips if there are blacklisted assets:
File: contracts/IndexLogic.sol (lines 125-140)
This means that users will be passed back inactive skipped assets even if they never deposited any.
I believe the && was meant to be a || in the SKIPPED_ASSET_ROLE in the code block directly above. Changing the code to be that way would be the fix.
olivermehr (Phuture Finance) disputed
jn-lp (Phuture Finance) commented:
moose-code (judge) commented:
