Fractional v2 contest - 0xSky's results

Lines of code

https://github.com/code-423n4/2022-07-fractional/blob/8f2697ae727c60c93ea47276f8fa128369abfe51/src/modules/Buyout.sol#L244-L273

Vulnerability details

Impact

Users can get cash from a successful buyout. In the Buyout.cash function, ethBalance is not updated after the token is burned and the user receives buyoutShare. As a result, users can get more cash than their share.

Proof of Concept

buyoutShare is calculated as follows.

uint256 buyoutShare = (tokenBalance * ethBalance) /
    (totalSupply + tokenBalance);

Let us say ethBalance is 1.0 for simplicity, and for two users, tokenBalance is also 1.0, respectively. For the first user, buyoutShare = 1.0 / 2.0 = 0.5 and this is correct. But for the second user, buyoutShare = 1.0, but the correct buyoutShare is 0.5 in this case.

Tools Used

VSCode

Recommended Mitigation Steps

Add the following line to the cash function.

buyoutInfo[_vault].ethBalance -= buyoutShare;

function cash(address _vault, bytes32[] calldata _burnProof) external {

    ...

    uint256 buyoutShare = (tokenBalance * ethBalance) /
        (totalSupply + tokenBalance);
    _sendEthOrWeth(msg.sender, buyoutShare);
+   buyoutInfo[_vault].ethBalance -= buyoutShare;
    // Emits event for cashing out of buyout pool
    emit Cash(_vault, msg.sender, buyoutShare);
}