The _depositToVaults
function in the VaultDepositController
contract incorrectly updates the totalRebonded
value. This leads to an inaccurate internal state.
In the _depositToVaults
function, when a vault is in its claim period, the entire deposits amount is added to totalRebonded
, regardless of the actual amount being deposited:
This can lead to an overestimation of totalRebonded if the actual deposit amount is less than the vault's total deposits.
Accounting Inaccuracy: The totalRebonded value will be inflated, leading to incorrect internal tracking of rebonded tokens.
Future Implications: If totalRebonded is used in future updates without correcting this issue, it could potentially lead to more problems.
Manual Review
Update the rebonding calculation to only account for the actual amount being deposited:
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.