DeFiFoundrySolidity
16,653 OP
View results
Submission Details
Severity: medium
Valid

Incorrect Calculation of `_totalAssets` using _harvestAndReport() in StrategyOp.sol

Summary

The claimable balance is overlooked in the calculation of _totalAssets, leading to an incomplete and potentially inaccurate accounting of the total assets held by the strategy.

Vulnerability Details

The vulnerablity arises because claimable value is ignored in the final calculation of the _totalAssets.

function _harvestAndReport()
internal
override
returns (uint256 _totalAssets)
{
@> uint256 claimable = transmuter.getClaimableBalance(address(this));
uint256 unexchanged = transmuter.getUnexchangedBalance(address(this));
// NOTE : possible some dormant WETH that isn't swapped yet
uint256 underlyingBalance = underlying.balanceOf(address(this));
_totalAssets = unexchanged + asset.balanceOf(address(this)) + underlyingBalance;
}

Although the claimable balance is calculated, it is not utilized in the subsequent logic. This omission means that the total assets are calculated without accounting for the claimable balance, which could lead to discrepancies in the reported _totalAssets value.

Impact

Incorrect calculation of the _totalAssets, The total assets value will be underreported since it does not reflect the full amount of assets held by the strategy, including any claimable balance.

Since the strategy relies on accurate total assets for profit and loss accounting, not including claimable funds means the strategy's performance is inaccurately reported. This can impact performance tracking, accounting, and the calculation of profits/losses.

Tools Used

Manual Review

Recommendations

  • Implement the logic , to include claimable value for calculating _totalAssets.

Updates

Appeal created

inallhonesty Lead Judge 8 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Incorrect accounting in `_harvestAndReport` claimable should be included

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.