First Flight #21: KittyFi
First Flight #21
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

KittyVault::getTotalMeowllateralInAave computes wrong values for totalCollateral

cryptedoji

Summary

The formula totalCollateralBase.mulDiv(PRECISION, uint256(collateralToUsdPrice) * EXTRA_DECIMALS) that is used in the above function to calculate the total collateral value in the aave vault is wrong. .

Vulnerability Details

Because the supposed numerator and denominator are used interchangeably, the formular leads to huge precision loss in the computation to the tune of over 1e8. This vulnerability directly affects EITHER the collateral depositors OR the protocol. if uint256(collateralToUsdPrice) * EXTRA_DECIMALS amounts to a value greater than PRECISION, the depositor gets more share(hence protocol loses) and vice versa.

Impact

  • loss of funds for user or protocol when calculating user share in the vault (depending on which of uint256(collateralToUsdPrice) * EXTRA_DECIMALS and PRECISION is bigger )

  • protocol may become insolvent if depositors get more shares than they deposted; OR part of user funds(collateral) may get stuck in the protocol

Tools Used

  • manual review

Recommendations

In order to get the accurate value of totalCollateral, the totalCollateralBase should be multiplied by the uint256(collateralToUsdPrice) * EXTRA_DECIMALS and then divided by the PRECISION

function getTotalMeowllateralInAave() public view returns (uint256) {
(uint256 totalCollateralBase, , , , , ) = i_aavePool.getUserAccountData(address(this));
​
(, int256 collateralToUsdPrice, , , ) = i_priceFeed.latestRoundData();
- return totalCollateralBase.mulDiv(PRECISION, uint256(collateralToUsdPrice) * EXTRA_DECIMALS);
+ return totalCollateralBase.mulDiv(uint256(collateralToUsdPrice) * EXTRA_DECIMALS, PRECISION);
}
Updates

Lead Judging Commences

shikhar229169 Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.