Closed c4-bot-5 closed 6 months ago
0xRobocop marked the issue as insufficient quality report
Intended behaviour that is industry standard (rounding in favor of the protocol) with extremely negligible monetary impact.
OpenCoreCH marked the issue as nullified
Lines of code
https://github.com/code-423n4/2024-02-hydradx/blob/main/HydraDX-node/math/src/omnipool/math.rs#L349
Vulnerability details
Impact
When LP calls the
remove_liquidity()
with one share to remove, he will get zero assets if the current asset is less than the position price, which is a loss for him.Proof of Concept
In
calculate_remove_liquidity_state_changes
, when we calculate the protocol shares, we add one share on the result in favor of the protocol.This is fine for pools where the shares are sufficient or the asset price is not high. But for other cases where the asset price is high, the LP may try to withdraw only one share, in which case the asset withdrawn to the LP will become zero, and his share will be burned.
Basically, the LP burns one share and gets nothing.
PoC:
Tools Used
Manual Review.
Recommended Mitigation Steps
In
calculate_remove_liquidity_state_changes
, we should make suredelta_reserve
is not zero.Assessed type
Context