Part 2
Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Vault WETH reward change is calculated wrong

topstar

Summary

Market::getVaultAccumulatedValues function incorrectly returns the WETH reward change values.

Vulnerability Details

  • vaultCreditShareX18 is the proportion of the total credit that belongs to the specific vault.

  • wethRewardChangeX18 is the total amount of WETH rewards that need to be distributed.

In the current implementation the wethRewardChangeX18 is calculated simply by subtracting wethRewardPerVaultShare - lastVaultDistributedWethRewardPerShareX18. Multiplying wethRewardChangeX18 by vaultCreditShareX18 converts these per-share changes into absolute changes for the vault.
Without this multiplication, the rewards allocated to each vault will not be proportional to their credit share, leading to discrepancies in reward distribution.

[src/market-making/leaves/Market.sol]
​
321 wethRewardChangeX18 = ud60x18(self.wethRewardPerVaultShare).sub(lastVaultDistributedWethRewardPerShareX18);

Impact

Vaults may receive more or fewer WETH rewards than they are entitled to based on their credit share.

Recommendations

The wethRewardChangeX18 should be multiplied by vaultCreditShareX18 to calculate the total WETH rewards changes that the specific vault is entitled to, based on its share of the total delegated credit.

. . .
​
+ wethRewardChangeX18 = !lastVaultDistributedWethRewardPerShareX18.isZero()
+ ? ud60x18(self.wethRewardPerVaultShare).sub(lastVaultDistributedWethRewardPerShareX18).mul(
+ vaultCreditShareX18
+ )
+ : UD60x18_ZERO;
​
. . .
Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

`wethRewardPerVaultShare` is incremented by `receivedVaultWethReward` amount which is not divided by number of shares.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.