DittoETH

Summary

Unsafe casting of getZethTotal function, which can lead to wrong yield rate calculation

Vulnerability Details

LibVault.updateYield casts getZethTotal into uint88. It also has comment that such cast is safe.

Let's check how getZethTotal works. It loops through all bridges and calculates current value.
As zethTotal for the vault is uint88, function assumes that getZethTotal can't be bigger than uint88. But it's not like that. zethTotal for the vault is actually eth amount and as we know brisges shoud increase amount over the time. Because of that it's possible that getZethTotal function will return value that is bigger than uint88 and it will be unsafely casted and corrupt calculations.

Impact

Value will be truncated.

Tools Used

VsCode

Recommendations

You can think about some limits of zethTotal that user's can't deposit more. I means that if you decided to use uint88, then do not allow to deposit up to this limit. Leave some gap for yields.