##Description:
AssetToken.updateExchangeRate(uint256 fee) computes:
This mixes different units: totalSupply() is in AssetToken units, while fee is collected in underlying token units. Once s_exchangeRate deviates from 1e18, the formula becomes wrong (it effectively scales the fee by s_exchangeRate), which can inflate the exchange rate beyond what the contract’s underlying balance can actually support.
##Impact:
Overstated exchange rate → AssetTokens become redeemable for more underlying than exists.
This can lead to protocol insolvency (LPs withdrawing more underlying than the pool holds), or forced reverts / stuck withdrawals depending on how redemption is implemented in the wider system.
##Proof of Concept:
Assume:
totalSupply = 1e18 (1 AssetToken)
s_exchangeRate = 2e18 (1 AssetToken = 2 underlying)
fee = 1e18 (1 underlying fee earned)
Correct accounting:
Underlying backing before fee = totalSupply * s_exchangeRate / 1e18 = 1e18 * 2e18 / 1e18 = 2e18 underlying
After fee, backing = 2e18 + 1e18 = 3e18 underlying
So correct newExchangeRate should be:
(backing * 1e18) / totalSupply = (3e18 * 1e18) / 1e18 = 3e18
Current code result:
newExchangeRate = 2e18 * (1e18 + 1e18) / 1e18 = 4e18
The exchange rate is inflated to 4 instead of 3, over-crediting LP claims by 33% in this example.
##Recommended Mitigation:
Update the exchange rate using consistent units (underlying-based accounting), e.g.:
Compute total underlying backing and add fee, then derive rate:
The contest is live. Earn rewards by submitting a finding.
Submissions are being reviewed by our AI judge. Results will be available in a few minutes.
View all submissionsThe contest is complete and the rewards are being distributed.