Submission Details
Severity:
L1: Mechanism to handle leap year
Summary
The function "_pendintInterest" will have a higher or lower rate per sec each leap year. As 2024 is a leap year, at launch the rate per sec will not the one expected.
Vulnerability Details
https://github.com/Cyfrin/2023-10-SteadeFi/blob/main/contracts/lending/LendingVault.sol
The constant is defined by this instruction :
21 uint256 public constant SECONDS_PER_YEAR = 365 days;
The variable _ratePerSec is defined by this instruction
460 uint256 _ratePerSec = _calculateInterestRate(totalBorrows, _floating) / SECONDS_PER_YEAR;
Impact
Partial loss of fund for the protocol or the users.
Tools Used
Manual Review
Recommendations
Prize pool breakdown
Total prize
35,000 USDC
nSLOC
2,28915 USDC / LOC
33,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.