# `fyToken` contribution limits are incorrect as they compare `fyToken` and `buyToken` amounts with `idoSize` in `idoToken` units Medium · Three Sigma · IDO launchpad · 7th August, 2024 Finding M-2 of the Blast IDO Pools security review. - Protocol: https://docs.blastup.io/blastup-docs - Report: /reports/blast-ido-pools - Source: https://cdn.sanity.io/files/qoqld077/production/d2a7ca81740e715b604122c12dafbce599e43f2f.pdf --- ### Description The `fyToken` contribution limit is enforced as: ```solidity uint256 globalTotalFunded = idoConfig.totalFunded[buyToken] + idoConfig.totalFunded[fyToken] + amount; ... uint256 maxFyTokenFunding = (idoConfig.idoSize * idoConfig.fyTokenMaxBasisPoints) / 10000; if (globalTotalFunded > maxFyTokenFunding) revert FyTokenContributionExceedsLimit(); ``` As can be seen, `maxFyTokenFunding` is in `idoToken` units (`idoSize` refers to `idoToken`) and `globalTotalFunded` in `fyToken` or `buyToken` units. ### Recommendation Make sure the limit is imposed by comparing the same units. --- Related findings: - [`TradingLimits::update()` incorrectly only rounds up when `deltaFlowUnits` becomes 0, which will silently increase trading limits](https://0xsimao.com/findings/mento-limits-delta-flow-becomes): Mento - [Lack of deadline in PowerToken.buy can lead to user's cashToken being distributed through ZeroToken holders](https://0xsimao.com/findings/m-0-deadline-cash-through-zero): M^0 Minter Gateway - [`LenderCommitmentGroup_Smart` does not use `mulDiv` when converting between token and share amounts, possibly leading to DoS or loss of funds](https://0xsimao.com/findings/teller-finance-mul-div-converting-share): Teller Finance - [Cds amounts to reduce from each chain are incorrect and will lead to the inability to withdraw cds in one of the chains](https://0xsimao.com/findings/autonomint-reduce-each-inability-withdraw): Autonomint