Submission Details
Severity:
Incorrect Token Amount Calculation in `StabilityPool::calculateRcrvUSDAmount` Function
Summary
The calculateRcrvUSDAmount function in the StabilityPool contract incorrectly calculates the rToken amount during deToken redemption, using an inverted formula compared to its counterpart calculateDeCRVUSDAmount.
Vulnerability Details
function calculateRcrvUSDAmount(uint256 deCRVUSDAmount) public view returns (uint256) {
uint256 scalingFactor = 10**(18 + rTokenDecimals - deTokenDecimals);
return (deCRVUSDAmount * getExchangeRate()) / scalingFactor; <==@found
}
Impact
Incorrect redemption amounts
Potential loss of funds for users
Tools Used
Manual Review
Recommendations
Use the correct formula for rToken redemption:
function calculateRcrvUSDAmount(uint256 deCRVUSDAmount) public view returns (uint256) {
uint256 scalingFactor = 10**(18 + rTokenDecimals - deTokenDecimals);
- return (deCRVUSDAmount * getExchangeRate()) / scalingFactor; <==@found
+ return (deCRVUSDAmount * scalingFactor) / getExchangeRate();
}
Updates
Lead Judging Commences
inallhonesty 4 months ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
Incorrect scaling factor formula in StabilityPool::calculateRcrvUSDAmount function
Both tokens have 18 decimals. Info
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.