PoolTogether - Brenzee's results

Lines of code

https://github.com/GenerationSoftware/pt-v5-vault/blob/main/src/Vault.sol#L1176

Vulnerability details

Impact

The vault exchange rate is directly dependent on the _yieldVault.maxWithdraw() value.

The issue occurs if _yieldVault withdrawals are paused. Per ERC-4626 standard rules - maxWithdraw "MUST factor in both global and user-specific limits, like if withdrawals are entirely disabled (even temporarily) it MUST return 0." Link to ERC-4626 documentation

This means that if _yieldVault withdrawals are paused, maxWithdraw value will be 0 and it is going deflate/inflate the exchange rate of the Vault, which may cause loss of funds for protocol or for user.

Proof of Concept

Vault._getExchangeRate function calls _yieldVault.maxWithdraw function. Value from it is used in the logic that happens next

    uint256 _withdrawableAssets = _yieldVault.maxWithdraw(address(this)); // @audit - Can return 0

    if (_withdrawableAssets > _totalSupplyToAssets) { // @audit - Will never be true if _withdrawableAssets is 0, go to next step
      _withdrawableAssets = _withdrawableAssets - (_withdrawableAssets - _totalSupplyToAssets);
    }

    if (_totalSupplyAmount != 0 && _withdrawableAssets != 0) { // @audit - Will never be true if _withdrawableAssets is 0, go to next step
      return _withdrawableAssets.mulDiv(_assetUnit, _totalSupplyAmount, Math.Rounding.Down); 
    }

    return _assetUnit; // @audit - Return _assetUnit as exchange rate

Example

Users interact with the Vault - they deposit and withdraw tokens, which means that the exchange rate has shifted from _assetUnit (which is the exchange rate when nothing is deposited in the _yieldVault)

All of a sudden _yieldVault owner has paused the withdrawals, which makes the maxWithdraw function return 0.

Now instead of having the exchange rate based on deposited/maxWithdraw values, the exchange rate will be 1, because the maxWithdraw function returns 0.

As a result - the exchange rate is either inflated or deflated, which may cause:

• Loss of funds for protocol (when exchange rate is inflated)
• Loss of funds for user (when exchange rate is deflated)

Tools Used

Manual Review

Recommended Mitigation Steps

Consider that maxWithdraw can return 0 even after the assets are deposited in the _yieldVault

Assessed type

Invalid Validation