First Flight #21: KittyFi
First Flight #21
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

`KittyVault::getUserVaultMeowllateralInEuros` Calculates the Price Incorrectly

4rdiii

[H-02] KittyVault::getUserVaultMeowllateralInEuros Calculates the Price Incorrectly

Summary

The getUserVaultMeowllateralInEuros function is designed to convert a user's collateral from dollars to euros. However, the calculation is flawed because it multiplies the dollar-denominated collateral value by the Euro to USD exchange rate, rather than dividing these two values.

Vulnerability Details

The getUserVaultMeowllateralInEuros function performs the incorrect calculation as follows:

function getUserVaultMeowllateralInEuros(
address _user
) external view returns (uint256) {
(, int256 collateralToUsdPrice, , , ) = i_priceFeed.latestRoundData();
(, int256 euroPriceFeedAns, , , ) = i_euroPriceFeed.latestRoundData();
@> uint256 collateralAns = getUserMeowllateral(_user).mulDiv(
@> uint256(collateralToUsdPrice) * EXTRA_DECIMALS,
@> PRECISION
@> );
@> return
@> collateralAns.mulDiv(
@> uint256(euroPriceFeedAns) * EXTRA_DECIMALS,
@> PRECISION
@> );
​
}
​

The current calculation is:

U_coll_USD = U_coll × C_to_USD
U_coll_EUR = U_coll_USD × EUR_to_USD

However, the correct calculation should be:

U_coll_USD = U_coll × C_to_USD
U_coll_EUR = U_coll_USD ÷ EUR_to_USD

Impact

This error affects the calculation of a user's health status, which is crucial for determining whether liquidation is necessary. Since the calculation results in a value that is always positive, users may remain liquidated longer than intended, posing a risk to the overall stability of the system.

Tools Used

Manual Review

Recommendations

Correct the calculation in the getUserVaultMeowllateralInEuros function to accurately reflect the conversion from dollars to euros:

function getUserVaultMeowllateralInEuros(
address _user
) external view returns (uint256) {
(, int256 collateralToUsdPrice, , , ) = i_priceFeed.latestRoundData();
(, int256 euroPriceFeedAns, , , ) = i_euroPriceFeed.latestRoundData();
uint256 collateralAns = getUserMeowllateral(_user).mulDiv(
uint256(collateralToUsdPrice) * EXTRA_DECIMALS,
PRECISION
);
return
- collateralAns.mulDiv(
- uint256(euroPriceFeedAns) * EXTRA_DECIMALS,
- PRECISION
- );
+ collateralAns.mulDiv(
+ PRECISION,
+ uint256(euroPriceFeedAns) * EXTRA_DECIMALS
+ );
​
}
​

This correction ensures that the user's collateral is accurately converted from dollars to euros, allowing for accurate assessments of their health status and timely liquidation decisions.

Updates

Lead Judging Commences

shikhar229169 Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

`getUserVaultMeowllateralInEuros` performs incorrect conversion from usdc to euro

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.