Lybra Finance - Bughunter101's results

Lines of code

https://github.com/code-423n4/2023-06-lybra/blob/main/contracts/lybra/miner/ProtocolRewardsPool.sol#L196

Vulnerability details

Impact

ProtocolRewardsPool.getReward() calc the result of eUSDShare is wrong. It will cause user lossing funds

Proof of Concept

As we can see, the eUSDShare calc is wrong.It should be uint256 eUSDShare = balance >= reward ? reward : balance;

    function getReward() external updateReward(msg.sender) {
        uint reward = rewards[msg.sender];
        if (reward > 0) {
            rewards[msg.sender] = 0;
            IEUSD EUSD = IEUSD(configurator.getEUSDAddress());
            uint256 balance = EUSD.sharesOf(address(this));
            uint256 eUSDShare = balance >= reward ? reward : reward - balance;//@audit It should be `uint256 eUSDShare = balance >= reward ? reward : balance;`
            EUSD.transferShares(msg.sender, eUSDShare);
            if(reward > eUSDShare) {
                ERC20 peUSD = ERC20(configurator.peUSD());
                uint256 peUSDBalance = peUSD.balanceOf(address(this));
                if(peUSDBalance >= reward - eUSDShare) {
                    peUSD.transfer(msg.sender, reward - eUSDShare);
                    emit ClaimReward(msg.sender, EUSD.getMintedEUSDByShares(eUSDShare), address(peUSD), reward - eUSDShare, block.timestamp);
                } else {
                    if(peUSDBalance > 0) {
                        peUSD.transfer(msg.sender, peUSDBalance);
                    }
                    ERC20 token = ERC20(configurator.stableToken());
                    uint256 tokenAmount = (reward - eUSDShare - peUSDBalance) * token.decimals() / 1e18;
                    token.transfer(msg.sender, tokenAmount);
                    emit ClaimReward(msg.sender, EUSD.getMintedEUSDByShares(eUSDShare), address(token), reward - eUSDShare, block.timestamp);
                }
            } else {
                emit ClaimReward(msg.sender, EUSD.getMintedEUSDByShares(eUSDShare), address(0), 0, block.timestamp);
            }
           
        }
    }

Tools Used

vs code

Recommended Mitigation Steps

It should be uint256 eUSDShare = balance >= reward ? reward : balance;

Assessed type

Math