Closed sherlock-admin closed 1 year ago
Escalate for 10 USDC
The POC above shows exactly how this part of the logic
if (gain > 0 && supply > 0) {
accCrvPerShares[gid] += (gain * 1e18) / supply;
}
failed to calculate the correct value of accCrvPerShares[gid]
Escalate for 10 USDC
The POC above shows exactly how this part of the logic
if (gain > 0 && supply > 0) { accCrvPerShares[gid] += (gain * 1e18) / supply; }
failed to calculate the correct value of
accCrvPerShares[gid]
You've created a valid escalation for 10 USDC!
To remove the escalation from consideration: Delete your comment.
You may delete or edit your escalation comment anytime before the 48-hour escalation window closes. After that, the escalation becomes final.
Escalation rejected
Invalid issue The example above uses the total supply of CRV but the code is using the total supply of the LP deposited into the gauge, not CRV.
Escalation rejected
Invalid issue The example above uses the total supply of CRV but the code is using the total supply of the LP deposited into the gauge, not CRV.
This issue's escalations have been rejected!
Watsons who escalated this issue will have their escalation amount deducted from their next payout.
Ch_301
high
users will steal/lose some CRV rewards from
WCurveGauge.sol
Summary
from Curve Docs
WCurveGauge.sol
have this logic to mint CRV reward for curve gauge and update the tracking system for rewardVulnerability Detail
On this POC I will take as an assumption the gauge has a constant weight to simplify the computation. This is the constant weight: If you deposit in the gaugeX 10 LP tokens you will receive 2 CRV every week (so if you deposit 20 LP tokens you will receive 4 CRV every week).
THE TIMELINE STARTS HERE Day_one:
WCurveGauge
)accCrvPerShares [ GaugeX_ID ] == 0
After_One_Week:
accCrvPerShares [ GaugeX_ID ] == 1
(the 1 comes from(gain / supply) + old value
so (2 / 2) + 0 =1)After_One_Week:
accCrvPerShares [ GaugeX_ID ] == 1.75
(6 / 8) + 1 =1.75)After_One_Week: if any user decides to close his position we should have these results
accCrvPerShares [ GaugeX_ID ] == 2.25
(6 / 8) + 1.75 =2.25) user_01 deposit 10 LP tokens for 3 weeks ==> 2 CRV 3 weeks = 6 CRV user_02 deposit 20 LP tokens for 2 weeks ==> 4 CRV 2 weeks = 8 CRV user_03 deposit 10 LP tokens for 1 week ==> 2 CRV * 1 week = 2 CRVTHE END OF THE TIMELINE
Let's take user_01 as an example: (POC) user_01 invoke burn() this logic will calculate the
rewards
we have: (ignore 1e18 )
stCrv
= 0 10 = 0enCrv
= 2.25 10 = 22.5 (we only have 16 CRV in this contract) soenCrv > stCrv
==>22.5 > 0 == true
rewards = enCrv - stCrv
==>22.5 - 0 = 22.5
sorewards
is22.5
CRV this amount is not even hereYou can do different scenarios with all the users and some of them end up stealing rewards (e.g:user_03 will receive 5 CRV so he gets an extra 3 CRV)
Impact
users will steal/lose some rewards from
WCurveGauge.sol
Code Snippet
Tool used
Manual Review
Recommendation
Update this part
from
_mintCrv()