Part 2
Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

VaultRouterBranch::getVaultCreditCapacity does not take zero return into account

i_atiq

Summary

The function getVaultCreditCapacity computes totalAssetsMinusVaultDebtX18 by addding 10^decimalOffset and then subtracting vaultDebtInAssetsX18. The vaultDebtInAssetsX18 can be negative value. So the output totalAssetsMinusVaultDebtX18 can still be zero. This zero output will revert in getVaultAssetSwapRate due to division by zero and getIndexTokenSwapRate will return zero assetsOut

Vulnerability Details

totalAssetsX18.add(sd59x18(int256(10 ** uint256(decimalOffset)))).sub(vaultDebtInAssetsX18);

  • vaultDebtInAssetsX18 can be negative, meaning totalAssetsMinusVaultDebtX18 can still be zero even after adding 10^decimalOffset.

  • If zero is passed to getVaultAssetSwapRate, it will cause a revert due to division by zero:

uint256 previewSharesOut = assetsIn.mulDiv(
IERC4626(vault.indexToken).totalSupply() + 10 ** decimalOffset,
totalAssetsMinusVaultDebt,
MathOpenZeppelin.Rounding.Floor
);

  • In getIndexTokenSwapRate, the output will be zero due to zero multiplication:

uint256 previewAssetsOut = sharesIn.mulDiv(
totalAssetsMinusVaultDebt,
IERC4626(vault.indexToken).totalSupply() + 10 ** decimalOffset,
MathOpenZeppelin.Rounding.Floor
);

  • getVaultCreditCapacity later converts totalAssetsMinusVaultDebtX18 to uint256:

uint256 totalAssetsMinusVaultDebt = vault.collateral.convertSd59x18ToTokenAmount(totalAssetsMinusVaultDebtX18);

  • If totalAssetsMinusVaultDebtX18 is negative, this will revert because converting a negative SD59x18 to uint256 is not possible.

Impact

  • If a vault has more negative debt than total asset in zlpVault, deposit and redeem and other operations will revert and fail, locking funds.

  • Unexpected reverts in getVaultAssetSwapRate due to division by zero, affecting vault operations.

Recommendation

Check if totalAssetsMinusVaultDebtX18 is zero, if true, add One and then return. If the totalAssetsMinusVaultDebtX18 is less than zero, multiply -1 and then convert it to token decimals

Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Validated
Assigned finding tags:

VaultRouterBranch::getVaultCreditCapacity does not take zero return into account

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!