_getDepositedBalance gives balance of account + collateral(balance of all vaults)
if a malicious party removes the vault of the user(since anyone can add/remove vaults of anyone if they are present in the cauldron) before some critical action involving a call to _getDepositedBalance, it will be miscalculated
_getDepositedBalance is used in _checkpoint and _checkpointAndClaim in state changing manner
hence during wrap, unwrap and getRewards function calls (which has at least one call to _getDepositedBalance) will result in miscalculation(lower) of rewards in _calcRewardIntegral due to not accounting for collateral of removed vaults
the worst-case scenario is the user is not able to claim any rewards because a frontrunning bot can always remove all vaults of the user before the call to wrap, unwrap, or getRewards function
Tools Used
Manual Review
Recommended Mitigation Steps
Put a condition so that only the user can remove his/her vaults.
Handle
hack3r-0m
Vulnerability details
Location: https://github.com/code-423n4/2022-01-yield/blob/main/contracts/ConvexYieldWrapper.sol#L100
_getDepositedBalance
gives balance of account + collateral(balance of all vaults)_getDepositedBalance
, it will be miscalculated_getDepositedBalance
is used in_checkpoint
and_checkpointAndClaim
in state changing mannerwrap
,unwrap
andgetRewards
function calls (which has at least one call to_getDepositedBalance
) will result in miscalculation(lower) of rewards in_calcRewardIntegral
due to not accounting for collateral of removed vaultsthe worst-case scenario is the user is not able to claim any rewards because a frontrunning bot can always remove all vaults of the user before the call to wrap, unwrap, or getRewards function
Tools Used
Manual Review
Recommended Mitigation Steps
Put a condition so that only the user can remove his/her vaults.