code-423n4 / 2022-06-notional-coop-findings

1 stars 1 forks source link

Upgraded Q -> H from 215 [1656255310294] #237

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Judge has assessed an item in Issue #215 as High risk. The relevant finding follows:

[L-09] wfCashERC4626 contract does not conform to EIP4626

Description

The wfCashERC4626 contract implements the EIP4626 standard (EIP-4626: Tokenized Vault Standard).

However, according to EIP4626, the below-mentioned functions do not fully adhere to the specs. They possibly revert due to require checks or revert due to external calls reverting.

Findings

L47 - function totalAssets() public view override returns (uint256)

Possibly reverts due to _getMaturedValue and _getPresentValue reverting.

L52 - function convertToShares(uint256 assets) public view override returns (uint256 shares)

Possibly reverts due to _getPresentValue and totalAssets reverting.

L64 - function convertToAssets(uint256 shares) public view override returns (uint256 assets)

Possibly reverts due to _getPresentValue and totalAssets reverting.

L85 - function maxWithdraw(address owner) public view override returns (uint256)

Possibly reverts due to convertToShares within previewWithdraw reverting.

Recommended mitigation steps

Given the circumstances, in most of the mentioned cases, it's not possible to implement it without ever reverting. Nevertheless, I want to point out that this contract does not fully conform with the EIP4626 standard.

gzeoneth commented 2 years ago

Duplicate of https://github.com/code-423n4/2022-06-notional-coop-findings/issues/155