c4-bot-2 commented 8 months ago

Lines of code

https://github.com/code-423n4/2024-02-spectra/blob/383202d0b84985122fe1ba53cfbbb68f18ba3986/src/tokens/PrincipalToken.sol#L377-L391

Vulnerability details

Impact

Function beforeYtTransfer() is not called before yield transfer in claimYieldInIBT()

Proof of Concept

Function beforeYtTransfer() is not called in claimYieldInIBT().

File: PrincipalToken.sol

    function claimYieldInIBT(address _receiver) public override returns (uint256 yieldInIBT) {
        yieldInIBT = _claimYield();
        if (yieldInIBT != 0) {
            IERC20(ibt).safeTransfer(_receiver, yieldInIBT);
        }
    }

Function claimYieldInIBT() performs a transfer of yield: IERC20(ibt).safeTransfer(_receiver, yieldInIBT), however, it does not call beforeYtTransfer() which updates yield: updateYield(_from), updateYield(_to).

This means, the calling claimYieldInIBT() won't update the yield properly, since it does not call beforeYtTransfer().