code-423n4 / 2023-11-kelp-findings

13 stars 11 forks source link

Upgraded Q -> 2 from #702 [1701456894100] #889

Closed c4-judge closed 11 months ago

c4-judge commented 11 months ago

Judge has assessed an item in Issue #702 as 2 risk. The relevant finding follows:

[L-03] Different price feeds decimals can cause accounting issues in LRTDepositPool::getRsETHAmountToMint As of now, all of the supported assets have priceFeeds with 18 decimals. However, there is always a chance that in the future, there might be a new supported asset with a price feed with decimals =! 18. The calculation of the tokens to mint will be wrong as user will lose funds if decimals < 18. Context :

function getRsETHAmountToMint(
    address asset,
    uint256 amount
)
    public
    view
    override
    returns (uint256 rsethAmountToMint)
{
    // setup oracle contract
    address lrtOracleAddress = lrtConfig.getContract(LRTConstants.LRT_ORACLE);
    ILRTOracle lrtOracle = ILRTOracle(lrtOracleAddress);

    // calculate rseth amount to mint based on asset amount and asset exchange rate

@> rsethAmountToMint = (amount * lrtOracle.getAssetPrice(asset)) / lrtOracle.getRSETHPrice(); } The (future) withdraw functionality will also be impacted.

c4-judge commented 11 months ago

fatherGoose1 marked the issue as duplicate of #479

c4-judge commented 11 months ago

fatherGoose1 marked the issue as satisfactory

c4-judge commented 11 months ago

This auto-generated issue was withdrawn by fatherGoose1