88834 sc low maxmint overstates the executable mint limit after exchange rate changes

Submitted on Aug 15th 2026 at 05:51:28 UTC by @QED for Audit Comp | Firelight

• Report ID: #88834

• Report Type: Smart Contract

• Report severity: Low

• Target: https://github.com/immunefi-team/audit-comp-firelight/blob/v1_audit_ready/contracts/core/FirelightVault.sol

• Impacts:

  • Contract fails to deliver promised returns, but doesn't lose value

Description

Brief/Intro

FirelightVault can return a positive ERC-4626 maxMint quote whose exact share amount cannot fit within the remaining asset capacity, causing compliant integrations to submit reverting mints.

Vulnerability Details

Affected target: FirelightVault at commit 42f9ea5e43d88b35197b901acc2a8c24b314fa62

Severity: Low

Asset: contracts/core/FirelightVault.sol

Root Cause

maxMint computes convertToShares(depositLimit) - totalSupply() instead of deriving the executable share amount from remaining asset capacity. The vault's virtual-asset/share conversion is not additive, while mint ceil-rounds the asset cost and _depositFunds rejects the resulting total when it exceeds depositLimit.

Attack Path

1

Deposit one asset

A depositor deposits one asset and receives one share.

2

Transfer an additional asset to the vault

Any underlying holder directly transfers one more asset to the vault, changing the state to one share backed by two assets under a three-asset limit.

3

Read the maximum mint quote

An ERC-4626 integration reads maxMint(receiver) = 1.

4

Preview the mint

previewMint(1) ceil-rounds the cost to two assets, although only one asset of capacity remains.

5

Attempt to mint

The integration calls mint(1, receiver), and the cap check reverts with DepositLimitExceeded.

Impact Details

ERC-4626 routers, allocators, frontends, and batched transactions can suffer reliable availability failures when they mint the advertised maximum after exchange-rate changes, but the defect does not enable theft or bypass the deposit limit.

References

• FirelightVault.maxMint

• FirelightVault.mint

• FirelightVault._depositFunds

• FirelightVault conversion formulas

• ERC-4626 specification

Recommended Fix

Compute maxMint from remaining asset capacity with mint-equivalent rounding and enforce with regression tests that previewMint(maxMint(receiver)) <= maxDeposit(receiver) across exchange-rate changes.

Link to Proof of Concept

https://gist.github.com/w-qedaudit/b8c9f3d72bf1c47f73955da7adaf1ed2

Proof of Concept

PoC gist: https://gist.github.com/w-qedaudit/b8c9f3d72bf1c47f73955da7adaf1ed2

Prerequisite: Git, Node.js, and npm must be installed with network access available for cloning and dependency installation.

The supplied poc.js is a temporary focused reproducer copied into the checked-out repository at runtime; it is not an in-tree project test or modification.

cd firelight/igtok1p3-maxmint-unexecutable
chmod +x run.sh
./run.sh

Expected successful output includes:

STATE totalSupply=1 totalAssets=2 depositLimit=3
QUOTE maxDeposit=1 maxMint=1 previewMint(maxMint)=2
RESULT mint(maxMint) reverted error=DepositLimitExceeded
POST totalSupply=1 totalAssets=2

The complete output from the verified execution is included in poc_output.txt.