Incorrect deposit check when canceling user's foreclosure in function deposit

[code423n4]

Handle

shw

Vulnerability details

Impact

In the function deposit of RCTreasury, a user's foreclosure can be canceled even if he did not deposit enough tokens for the minimum rent.

Proof of Concept

During a deposit, at line 303, the user's deposit is increased by the deposit amount. However, at line 309, when checking whether to cancel the user's foreclosure, user[_user].deposit + _amount is compared to the minimum rent. That is, the deposit amount is counted twice. Suppose that the minimum rent is x, then the foreclosed user only needs to deposit x/2 + 1 to cancel his foreclosure.

Referenced code:
RCTreasury.sol#L303
RCTreasury.sol#L309

Recommended Mitigation Steps

Change user[_user].deposit + _amount to user[_user].deposit at line 309.

[Splidge]

Duplicate of #26

[dmvt]

I generally think the impact of this on the rest of the system is minimal. It results in a slight advantage to the user in foreclosure, but does not cause a loss or granting of additional funds. To take advantage of this exploit, the user would also need to be highly skilled at reading source code to find the exploit in the first place. Even if they took the time to do this, the effect would not be permanent. I'm aligned with the view expressed in #26 and #37 that this is low severity.

[dmvt]

duplicate of #108