Lybra Finance - 0xNightRaven's results

Lines of code

https://github.com/code-423n4/2023-06-lybra/blob/7b73ef2fbb542b569e182d9abf79be643ca883ee/contracts/lybra/configuration/LybraConfigurator.sol#L303

Vulnerability details

Impact

The report highlights that the distributeRewards function can revert due to a strict slippage check. The provided proof of concept demonstrates the issue, where the slippage is set to 98%, leading to potential transaction failures.

Proof of Concept

function distributeRewards() external {
    uint256 peUSDBalance = peUSD.balanceOf(address(this));
    if (peUSDBalance >= 1e21) {
        peUSD.transfer(address(lybraProtocolRewardsPool), peUSDBalance);
        lybraProtocolRewardsPool.notifyRewardAmount(peUSDBalance, 2);
    }
    uint256 balance = EUSD.balanceOf(address(this));
    if (balance > 1e21) {
        uint256 price = curvePool.get_dy_underlying(0, 2, 1e18);
        if (!premiumTradingEnabled || price <= 1005000) {
            EUSD.transfer(address(lybraProtocolRewardsPool), balance);
            lybraProtocolRewardsPool.notifyRewardAmount(balance, 0);
        } else {
            EUSD.approve(address(curvePool), balance);
            uint256 amount = curvePool.exchange_underlying(0, 2, balance, balance * price * 998 / 1e21);
            IEUSD(stableToken).transfer(address(lybraProtocolRewardsPool), amount);
            lybraProtocolRewardsPool.notifyRewardAmount(amount, 1);
        }
    }
}

The vulnerability lies in the slippage check during the exchange operation:

curvePool.exchange_underlying(0, 2, balance, balance * price * 998 / 1e21);

The slippage is set to 98% (998/1000), which is too strict and can cause the transaction to revert.

Tools Used

Manual Review

Recommended Mitigation Steps

To address the issue, it is recommended to modify the distributeRewards function to allow users to input the slippage parameter. By allowing users to specify the desired slippage, they can adjust it according to their needs, ensuring that transactions do not revert unnecessarily. Implementing this change will provide flexibility and prevent potential failures due to overly strict slippage checks.

Assessed type

Token-Transfer