function totalUnderlyingMinusSponsored() public view returns (uint256) {
// TODO no invested amount yet
return totalUnderlying() - totalSponsored;
}
As a function that many other functions depended on, totalUnderlyingMinusSponsored() can revert on underflow when sponsorAmount > totalUnderlying() which is possible and has been considered elsewhere in this contract:
Handle
WatchPug
Vulnerability details
https://github.com/code-423n4/2022-01-sandclock/blob/a90ad3824955327597be00bb0bd183a9c228a4fb/sandclock/contracts/Vault.sol#L290-L293
As a function that many other functions depended on,
totalUnderlyingMinusSponsored()
can revert on underflow whensponsorAmount > totalUnderlying()
which is possible and has been considered elsewhere in this contract:https://github.com/code-423n4/2022-01-sandclock/blob/a90ad3824955327597be00bb0bd183a9c228a4fb/sandclock/contracts/Vault.sol#L390-L392
PoC
sponsor()
and send 10,000 USDTNonUSTStrategy.sol#doHardWork()
swapped USDT for USTdeposit()
, the tx will revet due to underflow intotalUnderlyingMinusSponsored()
.Recommendation
Change to: