Submission Details
Severity:
Can't redeem all tokens for liquidity providers
Summary
The liquidity providers can't redeem all tokens.
Vulnerability Details
When liquidity providers deposited tokens, the exchange rate updated. If liquidity providers redeem all tokens, the amountUnderlying is calculated by exchangeRate. The amountUnderlying will be bigger than deposited amount. The redeem() function will revert.
Impact
The liquidity providers can't redeem all tokens.
Tools Used
foundry
POC
function testRedeemAllFailed() public setAllowedToken hasDeposits {
vm.prank(liquidityProvider);
vm.expectRevert();
thunderLoan.redeem(tokenA, type(uint256).max);
}
Recommendations
It is recommended to delete the part of updating exchangeRate in deposit() function.
Delete:
uint256 calculatedFee = getCalculatedFee(token, amount);
assetToken.updateExchangeRate(calculatedFee);
Updates
Lead Judging Commences
0xnevi about 2 years ago
Submission Judgement Published Assigned finding tags:
can't redeem because of the update exchange rate
Rewards breakdown
nSLOC
387This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.