First Flight #21: KittyFi
First Flight #21
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

getTotalMeowllateralInAave () Lacks Interest Allocation Mechanism

bryanconquer

Summary

The getTotalMeowllateralInAave function in KittyVault.sol is designed to calculate the total collateral deposited in Aave. However, there is no mechanism implemented for distributing the earned interest back to the users proportionally.

Vulnerability Details

The function correctly calculates the total collateral in Aave but does not include any logic for distributing the interest earned from this collateral back to the users who deposited funds.

function getTotalMeowllateralInAave() public view returns (uint256) {
(uint256 totalCollateralBase, , , , , ) = i_aavePool.getUserAccountData(address(this));
(, int256 collateralToUsdPrice, , , ) = i_priceFeed.latestRoundData();
return totalCollateralBase.mulDiv(PRECISION, uint256(collateralToUsdPrice) * EXTRA_DECIMALS);
}
​

Impact

Users do not receive their share of the interest earned on their collateral. This discrepancy between the implemented code and the described functionality misleads users and may lead to dissatisfaction and loss of trust in the platform. It also fails to comply with the expected behavior, potentially causing financial harm to users who anticipated earning interest on their deposits.

Tools Used

Manual Review

Recommendations

Implement a mechanism to distribute the earned interest proportionally to the users based on their share of the total collateral. This could involve:

  1. Tracking individual user deposits.

  2. Calculating each user's share of the interest based on their proportional ownership of the total collateral.

  3. Periodically or on-demand distributing the earned interest to the users.

// Example of interest distribution mechanism (conceptual)
function distributeInterest() external onlyMaintainer {
uint256 totalInterestEarned = getTotalMeowllateralInAave() - totalDepositedCollateral;
for (uint256 i = 0; i < users.length; i++) {
address user = users[i];
uint256 userShare = (userDeposits[user] * totalInterestEarned) / totalDepositedCollateral;
userBalances[user] += userShare;
}
}
​
Updates

Lead Judging Commences

shikhar229169 Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.