Closed sherlock-admin3 closed 2 months ago
1 comment(s) were left on this issue during the judging contest.
WildSniper commented:
invalid due to - code redundancy issue and improvement submission
You can use the cached variable since price will not move.
merlin
high
The
_addLiquidity
function utilizes a cached sqrtPriceSummary
The
deposit, withdraw, moveTicks, setPositionWidth, and unpause
functions all call the internal_addLiquidity
function, which adds liquidity to the main and alternative positions. The problem lies in the fact that the function uses the cachedsqrtPriceX96
fromslot0
to calculate how much liquidity is obtained by adding ticks to the main position with our token balances and for the alternative position.Vulnerability Detail
1)The user calls the
deposit
function in theVault
, which in turn calls thedeposit
function inStrategyPassiveManagerVelodrome
. 2)Inside the_addLiquidity()
function, we determine the amount of liquidity gained by adding ticks to the main position based on our token balances and mint position:3)Next, we incorrectly determine the amount of liquidity gained by adding ticks to the alternative position based on our token balances, using the cached
sqrtPrice
. After we modify themain
position, thesqrtPriceX96
changes, but we continue to use it in calculations for thealternative
position, which is incorrect:Impact
The
_addLiquidity
function uses the cachedsqrtPriceX96
value for both the main and alternative positions, which will affect the calculations ofAmountsForLiquidity
for the alternative position after minting the main position, which changes thesqrtPriceX96
value.Code Snippet
contracts/strategies/velodrome/StrategyPassiveManagerVelodrome.sol#L254-L293
Tool used
Manual Review
Recommendation
Consider using the new
sqrtPriceX96
value: