Steadefi
Steadefi
DeFiHardhatFoundryOracle
35,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Wrong parameters used in conversion of equity value to svToken shares in processDeposit

angrymustacheman

Summary

Wrong formula is used for the calculation of conversion of equity value to svToken shares in processDeposit function.

Vulnerability Details

Formula for correct calculation of shares amount from equity value would be: (change in equity value * sharessupply)/(currentEquity)
And the same is used by protocol in valueToShares at GMXReader.sol at :
https://github.com/Cyfrin/2023-10-SteadeFi/blob/main/contracts/strategy/gmx/GMXReader.sol#L44C1-L57C1

/**
* @notice @inheritdoc GMXVault
* @param self GMXTypes.Store
*/
function valueToShares(
GMXTypes.Store storage self,
uint256 value,
uint256 currentEquity
) public view returns (uint256) {
uint256 _sharesSupply = IERC20(address(self.vault)).totalSupply() + pendingFee(self);
if (_sharesSupply == 0 || currentEquity == 0) return value;
return value * _sharesSupply / currentEquity;
}

The problem occurs when values are passed down from GMXProcessDeposit.sol::processDeposit. Here we can see , instead of present/current equity value, which is self.depositCache.healthParams.equityAfter, the previous/stale equity value has been passed on :
https://github.com/Cyfrin/2023-10-SteadeFi/blob/main/contracts/strategy/gmx/GMXProcessDeposit.sol#L26C3-L30C7

self.depositCache.sharesToUser = GMXReader.valueToShares(
self,
self.depositCache.healthParams.equityAfter - self.depositCache.healthParams.equityBefore,
self.depositCache.healthParams.equityBefore
);

Impact

More number of shares will be given to USER'S, as current equity value is being used in the denominator of the shares amount as can be seen above.

Tools Used

Manual Review

Recommendations

Change the value passed on to self.depositCache.healthParams.equityAfter from self.depositCache.healthParams.equityBefore

Updates

Lead Judging Commences

hans Lead Judge almost 2 years ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.