Open sherlock-admin opened 1 year ago
@weitianjie2000, although I do believe in the meta stable vaults the AMP precision is hardcoded to 1e3 in practice. We should go with the value that is returned from the method.
Looks good, it checks the returned precision should be equal to StableMath._AMP_PRECISION
.
ctf_sec
high
getGetAmplificationParameter() precision is not used, which result in accounting issue in MetaStable2TokenAuraHelper.sol and in Boosted3TokenAuraHelper.sol
Summary
getGetAmplificationParameter() precision is not used, which result in accounting issue in MetaStable2TokenAuraHelper.sol and in Boosted3TokenAuraHelper.sol
Vulnerability Detail
This report has two part,
part one trace the accounting issue in MetaStable2TokenAuraHelper.sol,
part two trace the accounting issue in Boosted3TokenAuraHelper.sol,
both issue rooted in not handling the getGetAmplificationParameter() precision
According to the Balancer documentation
https://dev.balancer.fi/resources/pool-interfacing/stable-pool#amplification-parameter
pool.getGetAmplificationParameter()
returns something resembling
value : 620000 isUpdating : False precision : 1000
where the amplification parameter is 620000 / 1000 = 620
but in the code, the isUpdating and precision returned is ignored and not used.
Part One
Let's trace the function reinvestReward in MetaStable2TokenAuraHelper.sol
It calls
then it calls
then it calls
Insite the function
What's wrong with this, I believe the precision has issue for ampParam
Because When we get the oracleContext.ampParam from MetaStable2TokenVaultMixin.sol
We did not use the precision returned from the pool
According to the Balancer documentation
https://dev.balancer.fi/resources/pool-interfacing/stable-pool#amplification-parameter
pool.getGetAmplificationParameter()
returns something resembling
value : 620000 isUpdating : False precision : 1000
where the amplification parameter is 620000 / 1000 = 620
The formula that calculate the spot price is
the function _calcSpotPrice hardcode the amp precision to 1e3;
and implement
if the pool's ampParameter is not equal to _AMP_PRECISION, the math will break.
Part Two
Let's trace the call in Boosted3TokenPoolUtils.sol
First the function reinvestReward in Boosted3TokenAuraHelper.sol is called
Then we call
then we call
then we call
then we call
we just use the amplificationParameter without handling the precision.
The amplificationParameter comes from BoostedTokenPoolMixin.sol
the isUpdating and precision is not used,
however, according to the documentation
According to the Balancer documentation
https://dev.balancer.fi/resources/pool-interfacing/stable-pool#amplification-parameter
pool.getGetAmplificationParameter()
returns something resembling
value : 620000 isUpdating : False precision : 1000
where the amplification parameter is 620000 / 1000 = 620
Impact
The amplificationParameter has precision, ignoring the precision will result in accounting issue.
If the precision of the amplificationParameter is not equal to hardcoded 1e3, the spot price is invalid.
the code
will be overvalued because we did not divide the value by the precision.
Code Snippet
For part one
https://github.com/sherlock-audit/2022-09-notional/blob/main/leveraged-vaults/contracts/vaults/balancer/external/MetaStable2TokenAuraHelper.sol#L114-L153
https://github.com/sherlock-audit/2022-09-notional/blob/main/leveraged-vaults/contracts/vaults/balancer/internal/math/Stable2TokenOracleMath.sol#L16-L41
https://github.com/sherlock-audit/2022-09-notional/blob/main/leveraged-vaults/contracts/vaults/balancer/mixins/MetaStable2TokenVaultMixin.sol#L22-L33
For part two
https://github.com/sherlock-audit/2022-09-notional/blob/main/leveraged-vaults/contracts/vaults/balancer/internal/pool/Boosted3TokenPoolUtils.sol#L379
https://github.com/sherlock-audit/2022-09-notional/blob/main/leveraged-vaults/contracts/vaults/balancer/internal/math/StableMath.sol#L320-L324
https://github.com/sherlock-audit/2022-09-notional/blob/main/leveraged-vaults/contracts/vaults/balancer/internal/math/StableMath.sol#L28-L56
https://github.com/sherlock-audit/2022-09-notional/blob/main/leveraged-vaults/contracts/vaults/balancer/mixins/Boosted3TokenPoolMixin.sol#L103-L117
Tool used
Manual Review
Recommendation
We recommend the project use the precision returned from getGetAmplificationParameter()