code-423n4 / 2021-04-vader-findings

1 stars 0 forks source link

Extra useless steps to calculate pooledVADER and pooledUSDV #287

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

paulius.eth

Vulnerability details

Impact

Here are some useless calculations: if(_token == VADER && _pool != VADER){ // Want to know added VADER addedAmount = _balance - pooledVADER; pooledVADER = pooledVADER + addedAmount; } else if(_token == USDV) { // Want to know added USDV addedAmount = _balance - pooledUSDV; pooledUSDV = pooledUSDV + addedAmount; if you do the simple maths, it is always in the first case, pooledVADER = _balance, in the second case pooledUSDV = _balance.

0xBrian commented 3 years ago

https://github.com/vetherasset/vaderprotocol-contracts/commit/ff278607361bf0923ec4c8eb0be3928b86acfb9c