DeFiFoundrySolidity
16,653 OP
View results
Submission Details
Severity: medium
Valid

Ignoring Claimable Balance in Total Assets Calculation Leads to Inaccurate Reporting

Description:

In the StrategyMainnet contract, the _harvestAndReport function is responsible for providing an accurate accounting of all funds currently held by the strategy. However, the function neglects to account for the claimable balance from the Transmuter. This omission can result in underreporting the total assets managed by the strategy, leading to incorrect profit and loss calculations.

Affected Function:

function _harvestAndReport()
internal
override
returns (uint256 _totalAssets)
{
uint256 claimable = transmuter.getClaimableBalance(address(this));
if (claimable > 0) {
// transmuter.claim(claimable, address(this));
}
// NOTE: we can do this in harvest or can do separately in tend
// if (underlying.balanceOf(address(this)) > 0) {
// _swapUnderlyingToAsset(underlying.balanceOf(address(this)));
// }
uint256 unexchanged = transmuter.getUnexchangedBalance(address(this));
uint256 underlyingBalance = underlying.balanceOf(address(this));
_totalAssets = unexchanged + asset.balanceOf(address(this)) + underlyingBalance;
}

Issue Details:

  • Claimable Balance Not Accounted For: The claimable balance represents the amount of underlying tokens (e.g., WETH) that can be claimed from the Transmuter. This balance is effectively part of the strategy's assets but is not included in the _totalAssets calculation.

  • Commented Out Claim Function: The line // transmuter.claim(claimable, address(this)); is commented out, meaning that the strategy is not actually claiming the underlying tokens, and therefore, the underlyingBalance does not include the claimable amount.

  • Impact on Asset Reporting: By not including the claimable balance, the strategy underreports its total assets. This can lead to incorrect profit/loss reporting and misinform stakeholders about the strategy's performance.

Impact:

  • Inaccurate Profit/Loss Reporting: Failing to account for all assets leads to incorrect calculations of gains or losses during the _harvestAndReport process.

  • Misleading Stakeholders: Investors and stakeholders may receive inaccurate information regarding the strategy's performance, impacting their investment decisions.

  • Financial Risk: The strategy might make decisions (e.g., fee calculations, redeployment strategies) based on incomplete asset data, potentially leading to financial losses.

Recommendation:

  • Include Claimable Balance in Asset Calculation:

    • Option 1: Claim the Underlying Tokens

      • Uncomment and use the transmuter.claim(claimable, address(this)); function call to convert the claimable balance into actual underlying tokens held by the strategy.

      • After claiming, the underlyingBalance will include the claimed tokens, ensuring they are accounted for in _totalAssets.

    • Option 2: Include Claimable Balance Directly

      • If it's not ideal to claim the tokens immediately (perhaps due to gas costs or timing considerations), directly include the claimable balance in the _totalAssets calculation.

      • Adjust the calculation to account for the value of the claimable balance, possibly converting it to the equivalent asset value if necessary.

Updates

Appeal created

inallhonesty Lead Judge 5 months ago
Submission Judgement Published
Validated
Assigned finding tags:

Incorrect accounting in `_harvestAndReport` claimable should be included

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.