Steadefi
Steadefi
DeFiHardhatFoundryOracle
35,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Valid

`additionalCapacity()` function uses same weights for the maximum borrowable amounts in both tokens can overestimate/underestimate the amounts

SupaRoutis

Summary

The additionalCapacity() function has been identified to potentially lead to inaccuracies in calculating the maximum borrowable amounts of assets due to the use of identical weights for different tokens.

Vulnerability Details

In the lending protocol, the additionalCapacity() function is responsible for determining the total amounts that users are allowed to borrow depending on the weights of the tokens in the GMX liquidity Pool and leverage.

However, it does not account for the weights of tokenB and uses tokenA's weights for the calculation of this amount.

uint256 _maxTokenBLending = convertToUsdValue(
self,
address(self.tokenB),
self.tokenBLendingVault.totalAvailableAsset()
) * SAFE_MULTIPLIER
@> / (self.leverage * _tokenAWeight / SAFE_MULTIPLIER)
- 1e18;

Also, the use of the magic number -1e18 seems unclear here. It seems like it is been used as a provision.

Impact

The best case scenario is that this amount is underestimated which will just slow down the lending. But if the amount is overestimated then the following check will pass :

function beforeDepositChecks(
GMXTypes.Store storage self,
uint256 depositValue
) external view {
if (self.status != GMXTypes.Status.Open)
revert Errors.NotAllowedInCurrentVaultStatus();
​
if (self.depositCache.depositParams.executionFee < self.minExecutionFee)
revert Errors.InsufficientExecutionFeeAmount();
​
if (!self.vault.isTokenWhitelisted(self.depositCache.depositParams.token))
revert Errors.InvalidDepositToken();
​
if (self.depositCache.depositParams.amt == 0)
revert Errors.InsufficientDepositAmount();
​
if (self.depositCache.depositParams.slippage < self.minSlippage)
revert Errors.InsufficientSlippageAmount();
​
if (depositValue == 0)
revert Errors.InsufficientDepositAmount(); // @audit redundant check
​
if (depositValue < MINIMUM_VALUE)
revert Errors.InsufficientDepositAmount();
​
@> if (depositValue > GMXReader.additionalCapacity(self))
revert Errors.InsufficientLendingLiquidity();
}

Tools Used

Manual review

Recommendations

​
uint256 _maxTokenBLending = convertToUsdValue(
self,
address(self.tokenB),
self.tokenBLendingVault.totalAvailableAsset()
) * SAFE_MULTIPLIER
- / (self.leverage * _tokenAWeight / SAFE_MULTIPLIER)
- 1e18;
​
uint256 _maxTokenBLending = convertToUsdValue(
self,
address(self.tokenB),
self.tokenBLendingVault.totalAvailableAsset()
) * SAFE_MULTIPLIER
+ / (self.leverage * _tokenBWeight / SAFE_MULTIPLIER)
- 1e18;
Updates

Lead Judging Commences

hans Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Lack of quality
maroutis Auditor
almost 2 years ago
hans Auditor
almost 2 years ago
hans Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

Wrong calculation of additional capacity

Impact: Medium Likelihood: High GMXReader::additionalCapacity calculation is wrong for a neutral case. Severity could be discussed further but because it is an evident logic error, likely to end as High.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.