search

code-423n4 / 2021-07-pooltogether-findings

0 stars 0 forks source link

Possible enhancements to supply/redeem full balance #79

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

pauliax

Vulnerability details

Impact

Consider adding functions in SwappableYieldSource to supply/redeem the whole balance of the user, so users will not need to pass an exact amount in case they want to fully join/exit the pool. Also, you can consider joining the BoostedVault for some extra rewards, however, I think then funds will need to be locked for some time for the rewards to start accruing.

PierrickGT commented 3 years ago

This feature can be handled on the frontend, this isn't the responsibility of the smart contract.

0xean commented 3 years ago

Disagree with sponsor. Due to the async nature of the call, additional interest could accrue to the user between the tx being created and then mined. Most likely, this represents dust, but still a nice feature in that scenario. Please correct me if I am missing something here.

PierrickGT commented 3 years ago

The redeemAllToken function has been added in the following commit: https://github.com/pooltogether/swappable-yield-source/pull/9/commits/e02fb5b8db7bb45333262cf93d837e10968cf343 Mainly a function that will be called by a contract or maybe a power user that wants to take advantage of the yield source only. For users joining a pool, we mint tickets that they can then redeem for the collateral they have deposited in the pool. So the exchange rate is 1:1 and their deposit will accrue interest for the prize pool but they are not able to withdraw the interest their deposit has contributed to the pool.