Closed code423n4 closed 2 years ago
If a vault becomes undercollateralised it will be captured by the liquidations engine pretty soon, until then we are ok with giving rewards.
Once the vault is captured by the liquidations engine it is owned by the liquidations engine and its collateral is not counted towards any rewards (unless someone checkpoints rewards for the liquidations engine, which is fine).
Once the vault is liquidated it is given back to the account. Before any rewards operation can be done, the rewards will be checkpointed again.
I believe there's merit to this finding, given higher severity findings related to transferring vaults.
However, this warden has submitted those higher severity findings, and for this one, a lack of clear POC makes it hard to verify whether this is an actual vulnerability.
Ultimately the rewards for the vault should be accrued even if the vault is undercollateralized, so given this rationale, I'll side with the sponsor and mark this invalid
Handle
leastwood
Vulnerability details
Impact
The
ConvexYieldWrapper.sol
contract makes use of a user's total collateral held by all their vaults, however, there is no check to ensure the vault is sufficiently collateralised. Hence, it is possible for a user to claim protocol generated yield on an undercollateralised vault.As per the
_getDepositedBalance
function, there are currently only checks to ensure thataccount_
is the owner before tallying the total collateral held by all owned vaults.Proof of Concept
https://github.com/yieldprotocol/vault-v2/blob/master/contracts/Cauldron.sol#L477-L495
https://github.com/code-423n4/2022-01-yield/blob/main/contracts/ConvexYieldWrapper.sol#L100-L120
Tools Used
Manual code review.
Recommended Mitigation Steps
Consider adding a
cauldron.level(userVault[i]) >= 0
check to_getDepositedBalance
to ensure only collateralised vaults are included in this calculation. However, it is important to note that if a vault was previously checkpointed as being collateralised, but becomes undercollateralised, any vault liquidations are reflected in the_getDepositedBalance
calculation.