The calcUnderlyingInStoredUSD() function of SherX should return calcUnderlyingInStoredUSD(getSherXBalance()) instead of calcUnderlyingInStoredUSD(sx20.balances[msg.sender]) since there could be SherX unallocated to the user at the time of the function call. A similar function, calcUnderlying(), calculates the user's underlying tokens based on the user's current balance plus the unallocated ones.
Handle
shw
Vulnerability details
Impact
The
calcUnderlyingInStoredUSD()
function ofSherX
should returncalcUnderlyingInStoredUSD(getSherXBalance())
instead ofcalcUnderlyingInStoredUSD(sx20.balances[msg.sender])
since there could be SherX unallocated to the user at the time of the function call. A similar function,calcUnderlying()
, calculates the user's underlying tokens based on the user's current balance plus the unallocated ones.Proof of Concept
Referenced code: SherX.sol#L141
Recommended Mitigation Steps
Change
sx20.balances[msg.sender]
togetSherXBalance()
at line 141.