search

code-423n4 / 2021-12-mellow-findings

0 stars 0 forks source link

Consider fees while calculating tvl of univ3 #134

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Handle

0x421f

Vulnerability details

As of now fees owed are not being considered I think here https://github.com/code-423n4/2021-12-mellow/blob/6679e2dd118b33481ee81ad013ece4ea723327b5/mellow-vaults/contracts/UniV3Vault.sol#L100

due to this A comes in deposits at time X his deposit genrates fess Now though B comes later, he gets unfair adv from As deposit

Just use pool.burn to update fees I think

MihanixA commented 2 years ago

Duplicates https://github.com/code-423n4/2021-12-mellow-findings/issues/98 IMO

0xleastwood commented 2 years ago

I'm not sure if I should treat this issue in the same way as #98 when it comes to calculating awards. The warden has not provided a clear path of how this might be exploited and has detailed lacklustre submission. What do you think @MihanixA ?

0xleastwood commented 2 years ago

After further deliberation, I have decided to mark this issue as invalid. The warden has submitted a low-quality submissions which on its own, would have not provided enough information to outline the issue if it wasn't for #98. As a result, I think it's unfair to treat these two issues as equivalent.

MihanixA commented 2 years ago

@0xleastwood I agree