An attacker can extract someone else's `ShareReward`

[c4-bot-6]

Lines of code

https://github.com/code-423n4/2024-05-bakerfi/blob/59b1f70cbf170871f9604e73e7fe70b70981ab43/contracts/core/Vault.sol#L224 https://github.com/code-423n4/2024-05-bakerfi/blob/59b1f70cbf170871f9604e73e7fe70b70981ab43/contracts/core/Vault.sol#L254

Vulnerability details

Impact

An attacker can extract someone else's ShareReward

Proof of Concept

1. Vault#deposit: shares = amount * totalSupply / _totalAssets

    function deposit(address receiver) ....{
        .....
        uint256 amount = abi.decode(result, (uint256));
        // shares = amount *  totalSupply / _totalAssets
        shares = total.toBase(amount, false);
        _mint(receiver, shares);
        emit Deposit(msg.sender, receiver, msg.value, shares);
    }

_totalAssets = totalCollateralInEth - totalDebtInEth

    function deployed(uint256 priceMaxAge) public view returns (uint256 totalOwnedAssets) {
        (uint256 totalCollateralInEth, uint256 totalDebtInEth) = _getPosition(priceMaxAge);
        totalOwnedAssets = totalCollateralInEth > totalDebtInEth
            ? (totalCollateralInEth - totalDebtInEth) : 0;
    }

2. withdrawAmount = share * totalAssets() / totalSupply()

3. When totalAssets > 0, the attacker can deposit and withdraw again and again, and the attacker will always get share until totalAssets = 0.

Tools Used

vscode, manual

Recommended Mitigation Steps

Modify the way rewards are distributed.

Assessed type

Error

[c4-bot-6]

Withdrawn by zhaojie