Part 2
Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

Missing multiplication in the logic

ChainDefenders

Summary

During the execution of getVaultAccumulatedValues, the protocol calculates the updated vault shares for a given market. However, if the market has multiple vaults, the calculation of WETH rewards is incorrect.

Vulnerability Details

Scenario

  1. Assume there are two vaults, both delegated with an equal amount of 50.

  2. The market distributes 2 WETH as rewards.

  3. The current implementation incorrectly assigns 2 WETH to each vault, resulting in a total of 4 WETH, which exceeds the available rewards.

Root Cause

  • The existing calculation does not consider the vault's proportional share of the total market delegation.

  • As a result, each vault receives the full WETH reward, rather than a fraction based on its share.

Impact

  • Over-distribution of WETH rewards, leading to an incorrect reward allocation.

  • Potential financial inconsistencies, as the protocol attempts to distribute more rewards than available.

  • Vulnerability to misallocation exploits, affecting fair distribution among vaults.

Tools Used

Manual review

Recommendations

Modify the reward calculation to ensure proportional distribution among multiple vaults:

usdcCreditChangeX18 = !lastVaultDistributedUsdcCreditPerShareX18.isZero()
? ud60x18(self.usdcCreditPerVaultShare).sub(lastVaultDistributedUsdcCreditPerShareX18).mul(
vaultCreditShareX18
)
: UD60x18_ZERO;
​
- wethRewardChangeX18 = ud60x18(self.wethRewardPerVaultShare).sub(lastVaultDistributedWethRewardPerShareX18);
+. wethRewardChangeX18 = ud60x18(self.wethRewardPerVaultShare)
+ .sub(lastVaultDistributedWethRewardPerShareX18)
+ .mul(vaultCreditShareX18);
Updates

Lead Judging Commences

inallhonesty Lead Judge 6 months ago
Submission Judgement Published
Validated
Assigned finding tags:

`wethRewardPerVaultShare` is incremented by `receivedVaultWethReward` amount which is not divided by number of shares.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.