Steadefi
Steadefi
DeFiHardhatFoundryOracle
35,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Inaccurate asset valuation due to changing reserve proportions assumption

hunter_w3b

Summary

The assetValue() function calculates token amounts based on the assumption that LP reserves stay proportional to total supply. However, reserve proportions are not fixed and can change over time.

Vulnerability Details

The function calculates asset amounts by taking the current reserve amounts, multiplying by the stored LP balance, and dividing by total supply. It assumes reserve balances change at the same rate as total supply. But if one reserve increases faster than the other due to trades, the proportions will change.

function assetValue(GMXTypes.Store storage self) public view returns (uint256) {
return lpAmt(self) * self.gmxOracle.getLpTokenValue(
address(self.lpToken),
address(self.tokenA),
address(self.tokenA),
address(self.tokenB),
false,
false
) / SAFE_MULTIPLIER;
}

Impact

f reserve proportions diverge significantly from assumptions, the reported asset value may be inaccurate. This undermines the integrity of position valuation and could mislead users over time.

Tools Used

Manual Review

Recommendations

Calculate token amounts directly from latest reserve balances, without relying on proportions.

Updates

Lead Judging Commences

hans Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Lack of quality

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.