sherlock-audit / 2024-05-beefy-cowcentrated-liquidity-manager-judging

5 stars 5 forks source link

Incorrect balance calculation #136

Closed sherlock-admin2 closed 2 months ago

sherlock-admin2 commented 2 months ago

Incorrect balance calculation

Low/Info issue submitted by nikolap

Summary

The function calculating the balances doesn't take into account how the tokens owed are calculated

Vulnerability Detail

the function positions always returns 0. You need to calculate the balances using the liquidity and the positions's range. It won't return 0 when increaseLiquidity, decreaseLiquidity or collect are called from the NonfungiblePositionManager contract. In this case when minting a position we never call the increaseLiquidity neither its being called anywhere else. Detail - The current owed tokens are never dynamic, so fetching a static value from what it actually is would also be considered wrong.

Impact

The estimate impact is not severe but its misleading and doesn't work as intended!

Code Snippet

https://github.com/sherlock-audit/2024-05-beefy-cowcentrated-liquidity-manager/blob/main/cowcentrated-contracts/contracts/strategies/velodrome/StrategyPassiveManagerVelodrome.sol#L558

Tool used

Manual Review

Recommendation

I would statically call the burn function returning me the correct token0Owed and token1Owed without submitting the tx.