BriVault
First Flight #52
Beginner FriendlySolidity
100 EXP
View results
Previous Next
Submission Details
Severity: high
Valid

Missing ERC4626 totalAssets() override may misreport vault balance

eze001

Root + Impact

Description

  • The vault inherits ERC4626 but does not correctly implement or override the totalAssets() function. This can cause the vault to misreport its total underlying assets, leading to incorrect share-to-asset conversions or integration issues with other DeFi protocols expecting accurate ERC4626 behavior.// Root cause in the codebase with @> marks to highlight the relevant section

Risk

Likelihood:

  • Occurs whenever front-end tools or other contracts query totalAssets() expecting the vault to report the real underlying balance.

  • Occurs whenever deposits/withdrawals are performed, causing totalSupply()/totalAssets() calculations to be inconsistent.

Impact:

  • Impact 1: Users may receive incorrect share conversions when depositing or withdrawing.

  • Impact 2: Integrations with other ERC4626‑aware protocols may fail or misbehave, potentially causing financial losses.

Proof of Concept

The inherited ERC4626 totalAssets() may not correctly return the total underlying assets if the vault has custom deposit/withdraw logic or internal accounting. This breaks share conversions.

// SPDX-License-Identifier: MIT
pragma solidity ^0.8.0;
​
import "@openzeppelin/contracts/token/ERC20/ERC20.sol";
​
contract ERC4626IntegrationTest {
VaultMissingTotalAssets public vault;
ERC20 public token;
​
constructor(VaultMissingTotalAssets _vault, ERC20 _token) {
vault = _vault;
token = _token;
}
​
function checkTotalAssets() external view returns (uint256) {
// Front-end or another protocol expects accurate totalAssets
return vault.totalAssets(); // may be inaccurate if not overridden
}
}
​

Recommended Mitigation

Override totalAssets() to return the vault’s actual underlying token balance, ensuring correct ERC4626 share calculations and safe integrations with other DeFi protocols.

- // totalAssets() not overridden
+ function totalAssets() public view override returns (uint256) {
+ // return the actual underlying token balance of the vault
+ return underlying.balanceOf(address(this));
+ }
​
Updates

Appeal created

bube Lead Judge 19 days ago
Submission Judgement Published
Validated
Assigned finding tags:

Unrestricted ERC4626 functions

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!