Liquidity Management

Summary

The _handleReturn function, responsible for calculating and returning collateral tokens to deposit recipient, has an issue with the fee refund process. The function first calls _burn, which deletes deposit information from depositInfo, and then attempts to refund the unused execution fee. Since depositInfo[depositId] is already deleted, the refund process fails due to missing owner and execution fee data.

Vulnerability Details

• The _handleReturn function calculates the amount of collateral tokens to be returned based on the deposit's share of totalShares.

• After computing the amount, it calls _transferToken to send the tokens to the deposit recipient.

• _burn(depositId) is called, which:

  • Removes the deposit from userDeposits.

  • Decreases totalShares.

  • Deletes the depositInfo[depositId] record.

• If refundFee is true, the function attempts to refund the unused execution fee.

• However, since _burn has benn called first it has deleted depositInfo[depositId], accessing depositInfo[depositId].executionFeeresults in default value(0).

Impact

• Refunds will always default to zero due to deleted deposit records.

• Execution fee refunds will not be processed, causing a loss to depositors.

Tools Used

Manual Review

Recommendations

Follow the correct order of actions:

1. Refund the execution fee to the deposit owner if refundFee = true

2. Call _burnto delete the proper deposit information