hats-finance / VMEX-0x050183b53cf62bcd6c2a932632f8156953fd146f

LP token lending protocol
MIT License
2 stars 1 forks source link

`pricePerShare()` function of yearnVault in `VMEXOracle.sol` is deprecated #16

Open hats-bug-reporter[bot] opened 1 year ago

hats-bug-reporter[bot] commented 1 year ago

Github username: -- Submission hash (on-chain): 0xdd8b44e1ca79e32073cd25eb4ebfbbe7b0f2632587ec730c898465caa571c654 Severity: medium severity

Description:

Summary

Within the getYearnPrice function, the pricePerShare() function of the Yearn finance instance is used to determine the token's price. However, it has been reported that the pricePerShare() function in the VMEXOracle.sol contract of Yearn Finance is deprecated.

Using a deprecated function may lead to incorrect or outdated price calculations. As a result, relying on the pricePerShare() function could produce inaccurate token price values and potentially impact the overall functionality and reliability of the system.

Code snippet

function getBeefyPrice(address asset) internal returns (uint256) {
        IBeefyVault beefyVault = IBeefyVault(asset);
        uint256 underlyingPrice = getAssetPrice(beefyVault.want());
        uint256 price = beefyVault.getPricePerFullShare()*underlyingPrice / 10**beefyVault.decimals();
        if(price == 0){
            return _fallbackOracle.getAssetPrice(asset);
        }
        return price;
    }

Recommendation

It is recommended to use getpricePerFullShare function https://docs.yearn.finance/developers/v1/interfaces#function-getpriceperfullshare

ksyao2002 commented 1 year ago

We communicated with the yearn team on this issue as all of our vaults use pricePerShare and there isn't a getPricePerFullShare. They let us know "getPrice... is from v1 vaults, not v2 Vaults." We are using all v2 vaults now, so this issue is invalid.