Submission Details
Severity:
The incorrect calculation will always cause the withdrawal to revert.
Summary
In calculateRcrvUSDAmount() function of StabilityPool.sol
function calculateRcrvUSDAmount(uint256 deCRVUSDAmount) public view returns (uint256) {
uint256 scalingFactor = 10**(18 + rTokenDecimals - deTokenDecimals);
return (deCRVUSDAmount * getExchangeRate()) / scalingFactor;
}
The formula is deCRVUSDAmount X getExchangeRate() X (10^deTokenDecimals) / (10^ (18 + rTokenDecimals)
The location of deTokenDecimals and rTokenDecimals have been swapped.
Impact
The function is used in withdraw() function.
function withdraw(uint256 deCRVUSDAmount) external nonReentrant whenNotPaused validAmount(deCRVUSDAmount) {
_update();
if (deToken.balanceOf(msg.sender) < deCRVUSDAmount) revert InsufficientBalance();
uint256 rcrvUSDAmount = calculateRcrvUSDAmount(deCRVUSDAmount); //used here
uint256 raacRewards = calculateRaacRewards(msg.sender);
if (userDeposits[msg.sender] < rcrvUSDAmount) revert InsufficientBalance();
userDeposits[msg.sender] -= rcrvUSDAmount;
if (userDeposits[msg.sender] == 0) {
delete userDeposits[msg.sender];
}
deToken.burn(msg.sender, deCRVUSDAmount);
rToken.safeTransfer(msg.sender, rcrvUSDAmount);
if (raacRewards > 0) {
raacToken.safeTransfer(msg.sender, raacRewards);
}
emit Withdraw(msg.sender, rcrvUSDAmount, deCRVUSDAmount, raacRewards);
}
If rTokenDecimals is not same as deTokenDecimals, rcrvUSDAmount will be different value than expected.
So might revert or withdraw small amount.
Tools Used
Manual
Recommendations
Need to change code as following.
function calculateRcrvUSDAmount(uint256 deCRVUSDAmount) public view returns (uint256) {
--- uint256 scalingFactor = 10**(18 + rTokenDecimals - deTokenDecimals);
+++ uint256 scalingFactor = 10**(18 + deTokenDecimals - rTokenDecimals);
return (deCRVUSDAmount * getExchangeRate()) / scalingFactor;
}
Updates
Lead Judging Commences
inallhonesty 4 months ago
Submission Judgement Published Reason: Non-acceptable severity
Assigned finding tags:
Incorrect scaling factor formula in StabilityPool::calculateRcrvUSDAmount function
Both tokens have 18 decimals. Info
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.