Submission Details
Severity:
KittyVault::executeDepawsit logic formular is flawed
Summary
In KittyVault::executeDepawsit, the user share in the vault is calculated with the wrong formular _cattyNipGenerated = _ameownt.mulDiv(totalCattyNip, _totalMeowllateral) because the numerator totalCattyNip and denominator _totalMeowllateral are used interchangeably.
Vulnerability Details
Impact
loss of funds for users
Tools Used
manual review
foundry chisel
Recommendations
function executeDepawsit(address _user, uint256 _ameownt) external onlyPool {
uint256 _totalMeowllateral = getTotalMeowllateral();
uint256 _cattyNipGenerated;
if (_totalMeowllateral == 0) {
_cattyNipGenerated = _ameownt;
}
else {
- _cattyNipGenerated = _ameownt.mulDiv(totalCattyNip, _totalMeowllateral);
+ _cattyNipGenerated = _ameownt.mulDiv(_totalMeowllateral, totalCattyNip);
}
userToCattyNip[_user] += _cattyNipGenerated;
totalCattyNip += _cattyNipGenerated;
totalMeowllateralInVault += _ameownt * PRECISION;
IERC20(i_token).safeTransferFrom(_user, address(this), _ameownt);
}
Rewards breakdown
nSLOC
224This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.