Submission Details
Severity:
Wrong usage of `returnIfBelowMin` in `_capLpTokenSupply()`
Summary
returnIfBelowMin should be used when lpTokenSupply is less than the minimum supply but it's used wrongly.
Vulnerability Details
In _capLpTokenSupply(), returnIfBelowMin is used when lpTokenSupply is greater than maxLpTokenSupply.
function _capLpTokenSupply(
uint256[] memory lastReserves,
uint256[] memory reserves,
uint256 capExponent,
CapReservesParameters memory crp,
IMultiFlowPumpWellFunction mfpWf,
bytes memory data,
bool returnIfBelowMin
) internal view returns (uint256[] memory cappedReserves) {
cappedReserves = reserves;
// Part 2: Cap LP Token Supply Change
uint256 lastLpTokenSupply = tryCalcLpTokenSupply(mfpWf, lastReserves, data);
uint256 lpTokenSupply = tryCalcLpTokenSupply(mfpWf, cappedReserves, data);
// If LP Token Supply increased, check that it didn't increase above the max.
if (lpTokenSupply > lastLpTokenSupply) {
bytes16 tempExp = ABDKMathQuad.ONE.add(crp.maxLpSupplyIncrease).powu(capExponent);
uint256 maxLpTokenSupply = tempExp.cmp(MAX_CONVERT_TO_128x128) != -1
? type(uint256).max
: lastLpTokenSupply.mulDiv(tempExp.to128x128().toUint256(), CAP_PRECISION2);
if (lpTokenSupply > maxLpTokenSupply) {
// If `_capLpTokenSupply` decreases the reserves, cap the ratio first, to maximize precision.
if (returnIfBelowMin) return new uint256[](0);
cappedReserves = tryCalcLPTokenUnderlying(mfpWf, maxLpTokenSupply, cappedReserves, lpTokenSupply, data);
}
// If LP Token Suppply decreased, check that it didn't increase below the min.
} else if (lpTokenSupply < lastLpTokenSupply) {
uint256 minLpTokenSupply = lastLpTokenSupply
* (ABDKMathQuad.ONE.sub(crp.maxLpSupplyDecrease)).powu(capExponent).to128x128().toUint256() / CAP_PRECISION2;
if (lpTokenSupply < minLpTokenSupply) {
cappedReserves = tryCalcLPTokenUnderlying(mfpWf, minLpTokenSupply, cappedReserves, lpTokenSupply, data);
}
}
}
According to the param's name, it should be used when lpTokenSupply is less than minLpTokenSupply in the else if clause.
Impact
_capLpTokenSupply() wouldn't work as intended because returnIfBelowMin is used in the wrong place.
Tools Used
Manual Review
Recommendations
returnIfBelowMin should be checked when lpTokenSupply < minLpTokenSupply.
Updates
Lead Judging Commences
giovannidisiena about 1 year ago
Submission Judgement Published Assigned finding tags:
Calc LP below min
giovannidisiena
about 1 year ago
giovannidisiena about 1 year ago
Submission Judgement Published Reason: Incorrect statement
Assigned finding tags:
Calc LP below min
Prize pool breakdown
Total prize
12,000 USDC
nSLOC
47925 USDC / LOC
10,000 USDC
1,000 USDC
1,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.