Alchemix Transmuter
Alchemix
DeFiFoundrySolidity
16,653 OP
View results
Previous Next
Submission Details
Severity: medium
Invalid

possible rounding error in availableWithdrawLimit

0xgondar

docs say that Recommended use is to have the amount returned not be close to the actual strategies totalAssets to avoid rounding issues.

In harvestAndReport totalAssets is calculated as

uint256 unexchanged = transmuter.getUnexchangedBalance(address(this));
// NOTE : possible some dormant WETH that isn't swapped yet (although we can restrict to only claim & swap in one tx)
uint256 underlyingBalance = underlying.balanceOf(address(this));
//@audit they forgot to add claimable here
_totalAssets = unexchanged + asset.balanceOf(address(this)) + underlyingBalance;
​

and in availableWithdrawLimit the return is calculated as

return asset.balanceOf(address(this)) + transmuter.getUnexchangedBalance(address(this));
​
​

So, if underlyingbalance is close to zero, this function might give rounding errors.

No rounding protection in availableWithdrawLimit

Yearn tokenized strategies docs state that recommended use is to have the amount returned not be close to the actual strategies totalAssets to avoid rounding issues.

In _harvestAndReport totalAssets is calculated as such:

uint256 unexchanged = transmuter.getUnexchangedBalance(address(this));
// NOTE : possible some dormant WETH that isn't swapped yet (although we can restrict to only claim & swap in one tx)
uint256 underlyingBalance = underlying.balanceOf(address(this));
_totalAssets = unexchanged + asset.balanceOf(address(this)) + underlyingBalance;
​

And in availableWithdrawLimit the return value is

return asset.balanceOf(address(this)) + transmuter.getUnexchangedBalance(address(this));
​
​

Thus if, for any reason, in the moment of call, the value of underlyingBalance is close to zero, the function will give rounding errors.

Impact

The protocol will suffer from faulty accounting.

Recommendation

Add a check to make sure that the amount returned from availableWithdrawLimit does not get close to the totalAssets

Updates

Lead Judging Commences

inallhonesty Lead Judge
6 months ago

Appeal created

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
0xgondar Submitter
5 months ago
inallhonesty Lead Judge
5 months ago
inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.