Steadefi
Steadefi
DeFiHardhatFoundryOracle
35,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

The additional capacity vault that can be deposited to vault may be misestimated for Neutral strategies

pontifex

Summary

Due to arithmetic mistake the GMXReader.additionalCapacity misestimates the additional capacity that can be deposited to vault based on available lending liquidity for Neutral strategies for tokenB.

Vulnerability Details

The GMXReader.additionalCapacity calculates the additional capacity that can be deposited to the vault. In case of Neutral strategies the function takes into account the tokens weight and the leverage in the way which is described in the comments. But the formula for the _maxTokenBLending variable uses _tokenAWeight instead of 1e18 - _tokenAWeight and subtracts 1e18 from the whole value instead of divider only.

246 // E.g: 3x Neutral ETH-USDC with weight of ETH being 55%, USDC 45%
247 // A $1 equity deposit should result in a $2 borrow for a total of $3 assets
248 // Amount of ETH to borrow would be $3 x 55% = $1.65 worth of ETH
249 // Amount of USDC to borrow would be $3 (asset) - $1.65 (ETH borrowed) - $1 (equity) = $0.35
​
254 if (self.delta == GMXTypes.Delta.Neutral) {
255 (uint256 _tokenAWeight, ) = tokenWeights(self);
​
264 uint256 _maxTokenBLending = convertToUsdValue(
265 self,
266 address(self.tokenB),
267 self.tokenBLendingVault.totalAvailableAsset()
268 ) * SAFE_MULTIPLIER
269 / (self.leverage * _tokenAWeight / SAFE_MULTIPLIER)
270 - 1e18;

Impact

This issue can cause unexpected errors and financial losses for small values.

Tools used

Manual Review

Recommendations

I suggest fixing the mistake this way:

uint256 _maxTokenBLending = convertToUsdValue(
self,
address(self.tokenB),
self.tokenBLendingVault.totalAvailableAsset()
) * SAFE_MULTIPLIER
+ / ((self.leverage * (1e18 - _tokenAWeight) / SAFE_MULTIPLIER)
+ - 1e18);
- / (self.leverage * _tokenAWeight / SAFE_MULTIPLIER)
- - 1e18;
Updates

Lead Judging Commences

hans Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

Wrong calculation of additional capacity

Impact: Medium Likelihood: High GMXReader::additionalCapacity calculation is wrong for a neutral case. Severity could be discussed further but because it is an evident logic error, likely to end as High.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.