BunniPrice::_getBunniReserves() does not add uncollected fee into total value calculation

Summary

BunniPrice::_getBunniReserves() does not add uncollected fee into total value calculation.

Vulnerability Detail

A bunni token is an erc20 token representing a uniswapv3 position with specific range. When the price enters this range, the position will get reward (uncollected fee). The fee is separated from the position, so it needs to be manually added to total value.

Impact

Incorrect reserve amount, since fee is not accounted into total value.

Code Snippet

https://github.com/sherlock-audit/2023-11-olympus/blob/main/bophades/src/modules/PRICE/submodules/feeds/BunniPrice.sol#L192-L207

Tool used

Manual Review

Recommendation

Consider add fee into calculation

    function _getBunniReserves(
        BunniToken token_,
        BunniLens lens_,
        uint8 outputDecimals_
    ) internal view returns (address token0, uint256 reserve0, address token1, uint256 reserve1) {
        BunniKey memory key = _getBunniKey(token_);
        (uint112 reserve0_, uint112 reserve1_) = lens_.getReserves(key);
    >>>    (uint256 fee0, uint256 fee1) = lens_.getUncollectedFees(key);

        // Get the token addresses
        token0 = key.pool.token0();
        token1 = key.pool.token1();
        uint8 token0Decimals = ERC20(token0).decimals();
        uint8 token1Decimals = ERC20(token1).decimals();
   >>>     reserve0 = uint256(reserve0_ + fee0).mulDiv(10 ** outputDecimals_, 10 ** token0Decimals);
   >>>     reserve1 = uint256(reserve1_ +fee1).mulDiv(10 ** outputDecimals_, 10 ** token1Decimals);
    }

Duplicate of #37

sherlock-audit / 2023-11-olympus-judging

tvdung94 - BunniPrice::_getBunniReserves() does not add uncollected fee into total value calculation #137