Submission Details
Severity:
Users would be minted fewer/more deToken tokens than intended
users can deposit rToken and receive deToken
function deposit(uint256 amount) external nonReentrant whenNotPaused validAmount(amount) {
_update();
@> rToken.safeTransferFrom(msg.sender, address(this), amount);
uint256 deCRVUSDAmount = calculateDeCRVUSDAmount(amount);
deToken.mint(msg.sender, deCRVUSDAmount);
userDeposits[msg.sender] += amount;
_mintRAACRewards();
emit Deposit(msg.sender, amount, deCRVUSDAmount);
}
The issue is that the function transfers rToken from the user before calculating calculateDeCRVUSDAmount, This would affect the supply of rToken before the amount to be minted is calculated.
Impact
Users would be mint fewer/more deToken depending on the exchangeRate calculation which on the current implementation is commented out.
Recommendation
function deposit(uint256 amount) external nonReentrant whenNotPaused validAmount(amount) {
_update();
- rToken.safeTransferFrom(msg.sender, address(this), amount);
uint256 deCRVUSDAmount = calculateDeCRVUSDAmount(amount);
+ rToken.safeTransferFrom(msg.sender, address(this), amount);
deToken.mint(msg.sender, deCRVUSDAmount);
userDeposits[msg.sender] += amount;
_mintRAACRewards();
emit Deposit(msg.sender, amount, deCRVUSDAmount);
Updates
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420
USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.