Submission Details
Severity:
`minted` is badly affected by `fee`
Summary
The state variable minted is treated differently in mint() and burn(), leading to inconsistencies in handling fees.
Vulnerability Details
In the SmartVaultV3::mint function, the minted state variable is incremented by both the _amount and the fee. However, in the SmartVaultV3::burn function, only the _amount is used to decrement minted, causing a disparity.
function mint(address _to, uint256 _amount) external onlyOwner ifNotLiquidated {
uint256 fee = _amount * ISmartVaultManagerV3(manager).mintFeeRate() / ISmartVaultManagerV3(manager).HUNDRED_PC();
require(fullyCollateralised(_amount + fee), UNDER_COLL);
minted = minted + _amount + fee; // @audit accounting the fees
EUROs.mint(_to, _amount);
EUROs.mint(ISmartVaultManagerV3(manager).protocol(), fee);
emit EUROsMinted(_to, _amount, fee);
}
function burn(uint256 _amount) external ifMinted(_amount) {
uint256 fee = _amount * ISmartVaultManagerV3(manager).burnFeeRate() / ISmartVaultManagerV3(manager).HUNDRED_PC();
minted = minted - _amount; // @audit no fees accounted
EUROs.burn(msg.sender, _amount);
IERC20(address(EUROs)).safeTransferFrom(msg.sender, ISmartVaultManagerV3(manager).protocol(), fee);
emit EUROsBurned(_amount, fee);
}
Impact
The state variable minted will hold an incorrect value, potentially leading to misrepresentations in the contract's accounting.
Tools Used
Manual Review
Recommendations
Do not take fee under account.
function mint(address _to, uint256 _amount) external onlyOwner ifNotLiquidated {
uint256 fee = _amount * ISmartVaultManagerV3(manager).mintFeeRate() / ISmartVaultManagerV3(manager).HUNDRED_PC();
- require(fullyCollateralised(_amount + fee), UNDER_COLL);
- minted = minted + _amount + fee;
+ require(fullyCollateralised(_amount), UNDER_COLL);
+ minted = minted + _amount;
EUROs.mint(_to, _amount);
EUROs.mint(ISmartVaultManagerV3(manager).protocol(), fee);
emit EUROsMinted(_to, _amount, fee);
}
Updates
Lead Judging Commences
hrishibhat almost 2 years ago
Submission Judgement Published Reason: Design choice
Assigned finding tags:
fee-loss
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
60933
USDC / LOC
17,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.