Closed sherlock-admin closed 1 year ago
Duplicate of #208.
Escalate for 50 USDC This is not a duplicate of #208. 208 is about lending or minting after maturity. This issue is specifically about minting-ipts-through-ipts. At the moment there are duped to #238 but as hyh correctly escalated there, they need their own topic.
Escalate for 50 USDC This is not a duplicate of #208. 208 is about lending or minting after maturity. This issue is specifically about minting-ipts-through-ipts. At the moment there are duped to #238 but as hyh correctly escalated there, they need their own topic.
You've created a valid escalation for 50 USDC!
To remove the escalation from consideration: Delete your comment. To change the amount you've staked on this escalation: Edit your comment (do not create a new comment).
You may delete or edit your escalation comment anytime before the 48-hour escalation window closes. After that, the escalation becomes final.
Escalation accepted
Escalation accepted
This issue's escalations have been accepted!
Contestants' payouts and scores will be updated according to the changes made on this issue.
Jeiwan
high
Users can receive less tokens during redeeming due to iPT inflation in the
mint
functionSummary
Users can receive less tokens during redeeming due to iPT inflation in the
mint
functionVulnerability Detail
The
mint
function ofLender
mints new iPT tokens when iPT tokens are deposited (Lender.sol#L270-L288). This inflates the supply of iPT tokens, which impairs iPT tokens redemption: redeemers will get a smaller share of the underlying tokens (Redeemer.sol#L422).Impact
An attacker can intentionally inflate the supply of iPT tokens of a specific maturity and reduce the number of underlying tokens redeemers will get during redeeming.
Code Snippet
Tool used
Manual Review
Recommendation
Consider disallowing minting of iPT tokens.
Duplicate of #108