Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Incorrect Shares Distribution When totalAmountBefore == 0

olami9783

Summary

The contract attempts to prevent division by zero by setting totalAmountBefore = 1 when totalAmountBefore == 0. However, this results in incorrect share allocation, allowing a new depositor to receive an unfairly high number of shares, potentially claiming all existing shares for free.

Vulnerability Details

uint256 totalAmountBefore;
if (positionIsClosed == false && _isLongOneLeverage(beenLong)) {
totalAmountBefore = IERC20(indexToken).balanceOf(address(this)) - amount;
} else {
totalAmountBefore = _totalAmount(prices) - amount;
}
if (totalAmountBefore == 0) totalAmountBefore = 1;
_shares = amount * totalShares / totalAmountBefore;

  • In the code it calculates totalAmountBefore based on existing contract balance.

  • Checks if totalAmountBefore == 0

    • if ture, sets totalAmountBefore = 1 to prevent division by zero
      EXPLOIT SCENARIO

  • totalShares = 1,000,000

  • totalAmountBefore = 0 (No active position or collateral)

  • A user notices that totalAmountBefore ==0 and prepares an exploit
    Depositor A deposits 1 token.(assume minimum deposit, get to know that irrespective of the minimum deposit set this will still be exploited).
    Contract sets totalAmountBefore = 1 to avoid division by zero
    Shares calculation

_shares = 1 * 1,000,000 / 1 =1,000,000

Depositor A now owns 100% of the total shares
If another user deposits later they get minimal shares.

Impact

  • A single malicious users can seize all contract shares

  • A new deposit gets an unfairly large number of shares

  • An attacker can monitor for tpotalAmountBefore == 0 and steal all existing shares with a small deposit.

Tools Used

Manual Review

Recommendations

if (totalAmountBefore == 0) {
totalAmountBefore =amount; // Ensure fair distribution for first deposit
_shares = amount * totalShares / totalAmountBefore;
}
Updates

Lead Judging Commences

n0kto Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

invalid_totalAmountBefore_is_1_incorrect_calculation_supposition

No proof when this can happen: Most of the time totalAmountBefore equals 0 (balance minus amount sent), it means totalShares equals 0. If it could happen with very specific conditions, report with that tag didn't add the needed details to be validated.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.