Submission Details
Severity:
`getVaultAccumulatedValues` will not account new debt if previous one was 0
Summary
In the getVaultAccumulatedValues the a wrong condition is used to account for debt change.
Vulnerability Details
The realized debt change will not account for any change when lastVaultDistributedRealizedDebtUsdPerShareX18 was zero.
realizedDebtChangeUsdX18 = !lastVaultDistributedRealizedDebtUsdPerShareX18.isZero()
? sd59x18(self.realizedDebtUsdPerVaultShare).sub(lastVaultDistributedRealizedDebtUsdPerShareX18).mul(
vaultCreditShareX18.intoSD59x18()
)
: SD59x18_ZERO;
This is incorrect as the first debt change will be accounted incorrectly.
Impact
First accumulated values will not be accounted properly
Tools Used
Manual Review
Recommendations
Remove the conditional logic.
Updates
Appeal created
novaman33
6 months ago
inallhonesty
6 months ago
inallhonesty 6 months ago
Submission Judgement Published Assigned finding tags:
Vault and market state updates are incorrectly skipped when lastVaultDistributed values are zero, requiring WETH fees before accounting starts working
Prize pool breakdown
Total prize
70,000 USDC
nSLOC
3,25821 USDC / LOC
66,500
3,500
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.