The depositCreditForMarket
function accepts deposits based on old vault states by not recalculating credit capacity beforehand.
The function directly updates market state without recalculating vault credit capacities.
The function updates market state directly at lines 335-341 without first recalculating credit capacities, which can lead to incorrect credit delegation amounts since it relies on potentially outdated vault states.
Interestingly, withdrawUsdTokenFromMarket recalculates the credit capacity before updating the market state which is intentional.
The protocol uses stale debt values for critical calculations which results in incorrect credit delegation amounts and misaligned reward distributions.
Add a call to recalculateVaultsCreditCapacity
at the beginning of depositCreditForMarket
function to ensure credit capacity calculations use up-to-date vault states.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.