The addMigratedUnderlying function in the UnripeFacet is vulnerable to scenarios where zero amounts can be processed, leading to incorrect underlying balances. This impacts the chop function, which relies on accurate underlying balances to calculate ripe tokens.
The addMigratedUnderlying function does not check if the amount being processed is zero. This leads to scenarios where the underlying balance is not incremented as expected, which subsequently affects calculations in the chop function that depend on accurate underlying balances.
Step-by-Step Scenario:
1: A user or function calls addMigratedUnderlying with a zero amount.
2: The incrementUnderlying function is called, but since the amount is zero, the balance remains unchanged.
3: The chop function calculates the amount of ripe tokens based on the unchanged underlying balance, leading to users receiving fewer ripe tokens than expected.
The chop function relies on the accurate calculation of the underlying balance to determine how many ripe tokens a user should receive when they "chop" their unripe tokens. Here’s an example to illustrate the impact of a zero amount:
1: Initial State:
Total Unripe Tokens: 100,000
Underlying Balance: 50,000 tokens
2: Expected Increment:
A call to addMigratedUnderlying is made with an amount of 10,000 tokens.
The underlying balance should increase to 60,000 tokens.
3: Actual Increment with Zero Amount:
If the call to addMigratedUnderlying is made with a zero amount:
The underlying balance remains at 50,000 tokens.
4: Impact on chop Calculation:
Suppose a user chops 1,000 unripe tokens.
Expected Calculation:
i: New Underlying Balance: 60,000 tokens
ii: Ripe Tokens per Unripe Token: 60,000 / 100,000 = 0.6 ripe tokens
iii: User should receive: 1,000 * 0.6 = 600 ripe tokens
Actual Calculation with Zero Amount:
i: New Underlying Balance: 50,000 tokens
ii: Ripe Tokens per Unripe Token: 50,000 / 100,000 = 0.5 ripe tokens
iii: User receives: 1,000 * 0.5 = 500 ripe tokens
4: The user receives 100 fewer ripe tokens than expected.
Users will receive fewer ripe tokens than they should, leading to financial discrepancies.
Incorrect token distributions will cause dissatisfaction among users, potentially harming the protocol's reputation.
Processing zero amounts incurs unnecessary gas costs and emits irrelevant events, leading to operational inefficiencies.
Manual review
1: Implement a check for zero amounts in the addMigratedUnderlying function to ensure that only positive amounts are processed.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.