The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Protocol distribute assets more than should be, resulting in lost of assets

thedoctor

Summary

In LiquidationPool::distributeAssets, it takes assets in USD and convert them to Euros then distributes the assets.

Vulnerability Details

In the implementation, the _portion has a duplication in multiplication. The LiquidationPool::stake returns the amount of Euros if TST is higher or which ever token is higher. The purpose of that function is to represents the total amount of portion owned in the liquidation pool. However, in the LiquidationPool::distributeAssets implementation, the portion multiply the stake again.

// LiquidationPool.sol
uint256 _positionStake = stake(_position);
...
uint256 _portion = asset.amount * _positionStake / stakeTotal;
...
_portion = _portion * _position.EUROs / costInEuros;
// LiquidationPool.sol
function stake(Position memory _position) private pure returns (uint256) {
return _position.TST > _position.EUROs ? _position.EUROs : _position.TST;
}
...
function distributeAssets(ILiquidationPoolManager.Asset[] memory _assets, uint256 _collateralRate, uint256 _hundredPC) external payable {
consolidatePendingStakes();
(,int256 priceEurUsd,,,) = Chainlink.AggregatorV3Interface(eurUsd).latestRoundData();
uint256 stakeTotal = getStakeTotal();
uint256 burnEuros;
uint256 nativePurchased;
for (uint256 j = 0; j < holders.length; j++) {
Position memory _position = positions[holders[j]];
uint256 _positionStake = stake(_position); // @audit
if (_positionStake > 0) {
for (uint256 i = 0; i < _assets.length; i++) {
ILiquidationPoolManager.Asset memory asset = _assets[i];
if (asset.amount > 0) {
(,int256 assetPriceUsd,,,) = Chainlink.AggregatorV3Interface(asset.token.clAddr).latestRoundData();
uint256 _portion = asset.amount * _positionStake / stakeTotal; // @audit asset has already multiply with stake
uint256 costInEuros = _portion * 10 ** (18 - asset.token.dec) * uint256(assetPriceUsd) / uint256(priceEurUsd)
* _hundredPC / _collateralRate;
if (costInEuros > _position.EUROs) {
_portion = _portion * _position.EUROs / costInEuros;
costInEuros = _position.EUROs;
}
_position.EUROs -= costInEuros;
rewards[abi.encodePacked(_position.holder, asset.token.symbol)] += _portion;
burnEuros += costInEuros;
if (asset.token.addr == address(0)) {
nativePurchased += _portion;
} else {
IERC20(asset.token.addr).safeTransferFrom(manager, address(this), _portion);
}
}
}
}
positions[holders[j]] = _position;
}
if (burnEuros > 0) IEUROs(EUROs).burn(address(this), burnEuros);
returnUnpurchasedNative(_assets, nativePurchased);
}

Impact

The portion of assets to be distributed to users due to the extra multiplication result in loss of assets in the protocol.

Tools Used

Manual Review

Recommendations

-- _portion = _portion * _position.EUROs / costInEuros;
++ _portion = _portion / costInEuros;
Updates

Lead Judging Commences

hrishibhat Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

precision

thedoctor Submitter
almost 2 years ago

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!