PoolTogether V5: Part Deux - Giorgio's results

Lines of code

https://github.com/GenerationSoftware/pt-v5-vault-boost/blob/9d640051ab61a0fdbcc9500814b7f8242db9aec2/src/VaultBooster.sol#L262-L279

Vulnerability details

Impact

The _computeAvailable function in VaultBooster.sol could potentially overstate the available balance in certain situations. Two functions rely on _computeAvailable for determining the available funds, such as liquidate, _accrue. If the overstated balance from _computeAvailable is larger than _amountOut, the function would not revert as it should when there are insufficient real funds. This would lead to an inconsistent state where boost.available reflects a balance larger than the actual tokens available in the contract,

Proof of Concept

The vulnerability lies in the _computeAvailable function: return boost.available + deltaAmount; If deltaAmount is greater than the actual available balance, the function can return a value larger than the real balance of the contract. Thus impacting the normal functioning of functions that rely on _computeAvailable, such as liquidate and _accrue.

Tools Used

Manual review

Recommended Mitigation Steps

To prevent this from happening, an additional check should be added in _computeAvailable function to ensure that the returned value does not exceed the contract's actual balance. This could be implemented at the end of computeAvailable.

uint256 computedAvailable = boost.available + deltaAmount;
return computedAvailable <= availableBalance ? computedAvailable : availableBalance;

Assessed type

Invalid Validation