Centrifuge - IceBear's results

The institutional ecosystem for on-chain credit.

General Information

Platform: Code4rena

Start Date: 08/09/2023

Pot Size: $70,000 USDC

Total HM: 8

Participants: 84

Period: 6 days

Judge: gzeon

Total Solo HM: 2

Id: 285

League: ETH

Centrifuge

Findings Distribution

Researcher Performance

Rank: 45/84

Findings: 1

Award: $50.43

🌟 Selected for report: 0

🚀 Solo Findings: 0

Awards

50.4324 USDC - $50.43

Labels

bug
2 (Med Risk)
satisfactory
sufficient quality report
duplicate-34

External Links

Lines of code

https://github.com/code-423n4/2023-09-centrifuge/blob/main/src/InvestmentManager.sol#L383 https://github.com/code-423n4/2023-09-centrifuge/blob/main/src/InvestmentManager.sol#L396

Vulnerability details

Impact

According to EIP-4626, previewMint and previewWithdraw should round up.

In previewMint and previewWithdraw, the currencyAmount is calculated by calling _calculateCurrencyAmount.

The _calculateCurrencyAmount performs calculations using round down, which can result in a lower returnTrancheTokenAmount than expected.

Proof of Concept

https://github.com/code-423n4/2023-09-centrifuge/blob/main/src/InvestmentManager.sol#L383

https://github.com/code-423n4/2023-09-centrifuge/blob/main/src/InvestmentManager.sol#L396

Tools Used

Calculations should take into account the requirements of EIP 4626 and use the correct rounding method.

Assessed type

ERC4626

#0 - c4-pre-sort

2023-09-14T23:49:19Z

raymondfam marked the issue as sufficient quality report

#1 - c4-pre-sort

2023-09-14T23:49:26Z

raymondfam marked the issue as duplicate of #34

#2 - c4-judge

2023-09-26T18:11:38Z

gzeon-c4 marked the issue as satisfactory

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter