Description

The atom announcer verifies the following parameters during the launch:

(assert
  (= DEPOSIT 0)
  (= DELAY 0)
  (= COOLDOWN_START 0)
  (= APPROVED 0)
  (= ATOM_VALUE 0)
  (= TIMESTAMP_EXPIRES 0)
  (= LAST_PENALTY_INTERVAL 0)
  (list ASSERT_MY_PARENT_ID LAUNCHER_ID)
)

However, it does not verify the MIN_DEPOSIT parameter, which should not be zero or a low value. As the atom announcer can only be approved via the governance, and hence the parameter can only be set via the governance, it is important to verify the validity of the parameter.

Impact

If the MIN_DEPOSIT value is low, the announcers could set their deposit to a very low value, and thus their penalty amount would be quite less. These announcers would be able to misbehave without penalty. This is not necessarily an issue because announcer approval passes through governance — which can verify their correct configuration. But this creates additional burden off chain, when the necessary checks could easily be done in the puzzles.

Recommendations

We recommend verifying the MIN_DEPOSIT amount in the atom_announcer puzzle.

Remediation

This issue has been acknowledged by Voltage Technologies Ltd., and fixes were implemented in the following commits:

• b7e18f7c↗
• 33f0bfe8↗