Liquidity Management

Summary

The vault's share calculation mechanism may lead to precision loss when small deposit amounts are involved. Specifically, when the deposit amount is small relative to the total vault balance, the calculated share amount may round down to zero, resulting in the depositor receiving no shares.

Vulnerability Details

Affected Code:

The share amount is calculated based on the ratio of the deposit amount to the total value of the vault. If the deposit amount is very small, integer division may result in _shares rounding down to zero.

Example:

• Suppose totalShares = 1,000,000 and totalAmountBefore = 1,000,000 collateral tokens.

• A deposit of 1 collateral token would result in:

However, if the total vault amount is very large, and the deposit is extremely small (e.g., 0.000001 collateral tokens), the result would round down to 0 due to integer division.

This effectively means the depositor receives no shares, and their deposit is effectively lost.

Full Context in _mint Function:

Impact

• Low Impact: Affects only very small deposits. Users making such deposits may not receive shares corresponding to their deposit.

• Likelihood: Low. Users are unlikely to deposit extremely small amounts compared to the vault's total balance.

Tools Used

Manual Code Review

Recommendations

1. Document the Behavior: Clarify in user-facing documentation that extremely small deposits may result in precision loss and ineffective deposits.

2. Set a Minimum Share Amount: Implement a minimum share amount threshold to ensure any deposit mints at least 1 share. For example:

Alternatively, reject deposits below a certain threshold that would result in zero shares.

Rationale

Setting a minimum share amount or documenting this behavior helps prevent user confusion and ensures that all deposits are meaningful.