First Flight #21: KittyFi
First Flight #21
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

`KittyVault.sol::getTotalMeowllateralInAave` Does not correctly calculate the collateral from Aave

coffee

Summary

KittyVault.sol::getTotalMeowllateralInAave Does not correctly calculate the collateral and collateral earned by interest from Aave.

Vulnerability Details

The line below does not correctly calculate the collateral returned from Aave. This causes an incorrect calculation of the amount of total collateral in the protocol to be returned anytime getTotalMeowllateralis called

return totalCollateralBase.mulDiv(PRECISION, uint256(collateralToUsdPrice) * EXTRA_DECIMALS);

The line above calculates like this:


PRECISION = 1e18

EXTRA_DECIMALS = 1e10

uint256(collateralToUsdPrice) = 2e8

totalCollateralBase = 3e18

(3e18 * 1e18) / (2e8 * 1e10)

Which equals = 1.5e18

But this is how it should calculate:

((2e8 * 1e10) / 1e18) * 3e18

Which equals = 6e18

The line below is the code that should be used

return totalCollateralBase.mulDiv(uint256(collateralToUsdPrice) * EXTRA_DECIMALS, PRECISION);

Impact

The test below fails showing that the calculation is not correct

function test_DepositAave() public {
uint256 toDeposit10 = 10 ether;
uint256 toDeposit20 = 20 ether;
​
// meowntainer transfers collateral in eth vault to Aave to earn interest
uint256 toSupply = 3 ether;
​
vm.startPrank(user);
​
IERC20(weth).approve(address(wethVault), toDeposit10);
kittyPool.depawsitMeowllateral(weth, toDeposit10);
​
vm.stopPrank();
​
vm.prank(meowntainer);
wethVault.purrrCollateralToAave(toSupply);
​
vm.startPrank(user2);
​
IERC20(weth).approve(address(wethVault), toDeposit20);
kittyPool.depawsitMeowllateral(weth, toDeposit20);
​
vm.stopPrank();
​
assertEq(wethVault.totalMeowllateralInVault(), toDeposit10 + toDeposit20 - toSupply);
assertEq(wethVault.totalCattyNip(), 38559907886052447696);
assertEq(IERC20(weth).balanceOf(address(wethVault)), toDeposit10 + toDeposit20);
​
assertEq(IERC20(weth).balanceOf(user), AMOUNT2 - toDeposit10);
}

Tools Used

--Foundry

Recommendations

It is recommended to change the return line in KittyVault.sol::getTotalMeowllateralInAaveto the correct equation.

function getTotalMeowllateralInAave() public view returns (uint256) {
(uint256 totalCollateralBase,,,,,) = i_aavePool.getUserAccountData(address(this));
​
(, int256 collateralToUsdPrice,,,) = i_priceFeed.latestRoundData();
- return totalCollateralBase.mulDiv(PRECISION, uint256(collateralToUsdPrice) * EXTRA_DECIMALS);
+ return totalCollateralBase.mulDiv(uint256(collateralToUsdPrice) * EXTRA_DECIMALS, PRECISION);
}
Updates

Lead Judging Commences

shikhar229169 Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.