Popcorn contest - JDeryl's results

A multi-chain regenerative yield-optimizing protocol.

General Information

Platform: Code4rena

Start Date: 31/01/2023

Pot Size: $90,500 USDC

Total HM: 47

Participants: 169

Period: 7 days

Judge: LSDan

Total Solo HM: 9

Id: 211

League: ETH

Popcorn

Findings Distribution

Researcher Performance

Rank: 148/169

Findings: 1

Award: $35.48

QA:
grade-b

🌟 Selected for report: 0

🚀 Solo Findings: 0

File - Line No

Vault.sol - L187

Miscalculation in mint() can lead to insolvent positions

The mint function uses convertToAssets() which rounds down the given number of shares to calculate a lesser number of assets.

According to the documentation of ERC4626 and as performed in the previewMint(), the mint function must also round up the conversion of shares to assets such that the vault is never forced to mint more shares than the asset it holds.

Recommendation:

The mint() must ensure that either be the first user of the Vault or in any other case, the minted shares are always less than equal to the number of assets held by the Vault. Therefore, rounding up the shares during the conversion to asset must ensure that the shares are always constrained.

#0 - c4-judge

2023-02-28T14:28:45Z

dmvt marked the issue as grade-b

AuditHub

A portfolio for auditors, a security profile for protocols, a hub for web3 security.

Built bymalatrax © 2024

Auditors

Browse

Contests

Browse

Get in touch

ContactTwitter