Closed sherlock-admin3 closed 5 months ago
1 comment(s) were left on this issue during the judging contest.
panprog commented:
invalid, the vault claim amount has nothing to do with EIP4626
Invalid as seen below. Additionally, the watson lacks proof of impact for what seems to be small rounding errors (check)
Is the code/contract expected to comply with any EIPs? Are there specific assumptions around adhering to those EIPs that Watsons should be aware of?
No
4b
medium
Vault Rounding Issue in
Vault.sol::_update
Summary
according EIP4626 Rounding Specification the
claimAmount
should be rounded up.Vulnerability Detail
this protocol rounds down the
claimAmount
by default .t According to the EIP4626 rounding specification the rounding of theclaimAmount
must be up but the_socialize
function which returns theclaimAmount
doesn't take into condition that constraint and just runs it down by default.Impact
this current implementation will round down the
claimAmount
expected instead of otherwise.Code Snippet
claimAmount
UFixed6 claimAmount = _socialize(context, claimAssets);
Vault.sol::_socialize
Tool used
Manual Review
Recommendation
the implementation of
_socialize
should be checked to make sureclaimAmount
will have a rounded up value