mediumLogic errorEVM-Solidity
Rova: `userTokens` accounting in `Launch.sol::updateParticipation` is updated incorrectly and can lead to loss of user funds, DOS and a broken invariant
- Payout
- $0
- Protocol
- Rova
- Disclosed
- Feb 19, 2025
- Source
- sherlock
In Rova's Launch contract, the updateParticipation function, when a user lowers their requested token amount in a launch group sale, incorrectly updates the _userTokensByLaunchGroup accounting by subtracting the refund currency amount from the stored token tot …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.