Closed code423n4 closed 1 year ago
0xA5DF marked the issue as duplicate of #396
hansfriese marked the issue as selected for report
hansfriese marked the issue as not selected for report
hansfriese marked the issue as duplicate of #396
hansfriese marked the issue as satisfactory
Lines of code
https://github.com/code-423n4/2023-04-frankencoin/blob/1022cb106919fba963a89205d3b90bf62543f68f/contracts/Equity.sol#L276-L283
Vulnerability details
FPS
holders can redeem their shares againstzchf
usingredeem()
The issue is that there is no slippage in this function. As the amount of
zchf
computed incalculateProceeds()
is a function ofequity
, events happening in the same block before theredeem()
call can affect the amount ofzchf
received by the userImpact
Users can receive less than expected.
But if a big equity loss happens resulting in
zchf.equity
returning 0,calculateProceeds
will return 0, meaning the user will see their shares being burnt without receiving anyzchf
.While it can be argued that the user shares were worth nothing due to the equity loss, in the case of the "brave soul" ready to save the protocol - mentioned in the case scenario here, they will have lost the ability and incentive to do so.
Tools Used
Manual Analysis
Mitigation
Add a slippage parameter in
redeem()
Users will be able to estimate how much they can expect using
calculateProceeds()
.