*/
function claim(address account) external {
(EpochContext memory context, ) = _settle(account);
UFixed18 unclaimedAmount = _unclaimed[account];
UFixed18 unclaimedTotal = _totalUnclaimed;
_unclaimed[account] = UFixed18Lib.ZERO;
_totalUnclaimed = unclaimedTotal.sub(unclaimedAmount);
emit Claim(msg.sender, account, unclaimedAmount);
// pro-rate if vault has less collateral than unclaimed
UFixed18 claimAmount = unclaimedAmount;
UFixed18 totalCollateral = _assets();
if (totalCollateral.lt(unclaimedTotal)) claimAmount = claimAmount.muldiv(totalCollateral, unclaimedTotal);
_rebalance(context, claimAmount);
asset.push(account, claimAmount);
}
In case, when asset balance is less than unclaimedTotal, then users will receive less amount.
if (totalCollateral.lt(unclaimedTotal)) claimAmount = claimAmount.muldiv(totalCollateral, unclaimedTotal);
totalCollateral is not stale value as it's changing with every position closing and settlement. As such it's possible that sometimes totalCollateral can become less than unclaimedTotal and then in some time become bigger again.
Malicious user can wait for such events in order to claim less amount to the claimers, who didn't claim yet.
As result of this he can increase amount per share for the users who still in the vault and make losses for users, that are now claimed by him.
Impact
User;s account can be claimed not in the best time and make losses.
Code Snippet
Provided above
Tool used
Manual Review
Recommendation
Do not allow someone else to claim user's account.
rvierdiiev
medium
BalancedVault.claim can be called in not favorable situation
Summary
BalancedVault.claim can be called in not favorable situation to make claimer receive less.
Vulnerability Detail
BalancedVault.claim
can be called by anyone. You need to provide account, which will be claimed. https://github.com/sherlock-audit/2023-05-perennial/blob/main/perennial-mono/packages/perennial-vaults/contracts/balanced/BalancedVault.sol#L210-L228In case, when asset balance is less than
unclaimedTotal
, then users will receive less amount.if (totalCollateral.lt(unclaimedTotal)) claimAmount = claimAmount.muldiv(totalCollateral, unclaimedTotal);
totalCollateral
is not stale value as it's changing with every position closing and settlement. As such it's possible that sometimestotalCollateral
can become less thanunclaimedTotal
and then in some time become bigger again.Malicious user can wait for such events in order to claim less amount to the claimers, who didn't claim yet. As result of this he can increase amount per share for the users who still in the vault and make losses for users, that are now claimed by him.
Impact
User;s account can be claimed not in the best time and make losses.
Code Snippet
Provided above
Tool used
Manual Review
Recommendation
Do not allow someone else to claim user's account.
Duplicate of #174