Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Incorrect token is used to calculate shares in the _mint function.

typical_human

Summary

The protocol's vault is designed to hold two tokens: an index token and a collateral token. Users deposit the collateral token to enter the vault. The issue lies in the share calculation formula within the _mint function - it subtracts the amount provided by the user from the index token balance. This approach is incorrect because the function deals with two different tokens, which have varying decimal places and values, making direct subtraction invalid.

Vulnerability Details

Let's examine the _mint function:

function _mint(uint256 depositId, uint256 amount, bool refundFee, MarketPrices memory prices) internal {
uint256 _shares;
if (totalShares == 0) {
_shares = depositInfo[depositId].amount * 1e8;
} else {
uint256 totalAmountBefore;
if (positionIsClosed == false && _isLongOneLeverage(beenLong)) {
@> totalAmountBefore = IERC20(indexToken).balanceOf(address(this)) - amount;
} else {
totalAmountBefore = _totalAmount(prices) - amount;
}
if (totalAmountBefore == 0) totalAmountBefore = 1;
_shares = amount * totalShares / totalAmountBefore;
}
​
depositInfo[depositId].shares = _shares;
totalShares += _shares;
​
if (refundFee) {
uint256 usedFee = callbackGasLimit * tx.gasprice;
if (depositInfo[counter].executionFee > usedFee) {
try IGmxProxy(gmxProxy).refundExecutionFee(depositInfo[counter].owner, depositInfo[counter].executionFee - usedFee) {} catch {}
}
}
​
emit Minted(depositId, depositInfo[depositId].owner, _shares, amount);
}

The issue is in the following line:

totalAmountBefore = IERC20(indexToken).balanceOf(address(this)) - amount;

This is incorrect because amount represents the collateral token, but the function deducts it from the index token balance. Since these are two different tokens with potentially different decimal places and values, direct subtraction is not valid.

Impact

An incorrect formula could lead to inaccurate share calculations or even DoS vulnerability due to decimal mismatches.

Tools Used

Manual review.

Recommendations

Use collateralToken.balanceOf(address(this)) instead.

Updates

Lead Judging Commences

n0kto Lead Judge 7 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement
Assigned finding tags:

Suppositions

There is no real proof, concrete root cause, specific impact, or enough details in those submissions. Examples include: "It could happen" without specifying when, "If this impossible case happens," "Unexpected behavior," etc. Make a Proof of Concept (PoC) using external functions and realistic parameters. Do not test only the internal function where you think you found something.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.