The Protocol implements two different formula for calculation of assets and share values.
function previewMint(uint256 shares) public view returns (uint256 assets) {
unchecked {
assets = Math.mulDivRoundingUp(
shares * DECIMALS,
totalAssets(),
totalSupply * (DECIMALS - COMMISSION_FEE)
);
}
}
function previewDeposit(uint256 assets) public view returns (uint256 shares) {
// compute the MEV tax, which is equal to a single payment of the commissionRate on the FINAL (post mev-tax) assets paid
unchecked {
shares = Math.mulDiv(
assets * (DECIMALS - COMMISSION_FEE),
totalSupply,
totalAssets() * DECIMALS
);
}
}
Proof of Concept
for simplicity i will ignore the decimal portion here suppose we have following values:
Lines of code
https://github.com/code-423n4/2024-04-panoptic/blob/main/contracts/CollateralTracker.sol#L399-L408 https://github.com/code-423n4/2024-04-panoptic/blob/main/contracts/CollateralTracker.sol#L453-L468
Vulnerability details
Impact
The Protocol implements two different formula for calculation of
assets
andshare
values.Proof of Concept
for simplicity i will ignore the decimal portion here suppose we have following values:
The user lose 1 assets due to difference in the formula
Tools Used
Manual Review
Recommended Mitigation Steps
Try to implement same formula for both cases.
Assessed type
ERC4626