Lybra Finance - OMEN's results

Lines of code

https://github.com/code-423n4/2023-06-lybra/blob/7b73ef2fbb542b569e182d9abf79be643ca883ee/contracts/lybra/pools/base/LybraPeUSDVaultBase.sol#L201-L207

Vulnerability details

Impact

function _repay(address _provider, address _onBehalfOf, uint256 _amount) internal virtual { try configurator.refreshMintReward(_onBehalfOf) {} catch {} _updateFee(_onBehalfOf); uint256 totalFee = feeStored[_onBehalfOf]; uint256 amount = borrowed[_onBehalfOf] + totalFee >= _amount ? _amount : borrowed[_onBehalfOf] + totalFee; if(amount >= totalFee) { feeStored[_onBehalfOf] = 0; PeUSD.transferFrom(_provider, address(configurator), totalFee); PeUSD.burn(_provider, amount - totalFee); } else { feeStored[_onBehalfOf] = totalFee - amount; PeUSD.transferFrom(_provider, address(configurator), amount); } try configurator.distributeRewards() {} catch {} borrowed[_onBehalfOf] -= amount; poolTotalPeUSDCirculation -= amount;

    emit Burn(_provider, _onBehalfOf, amount, block.timestamp);
}

scenario 1 ,borrowed[_onBehalfOf] is 1000 and totalFee is 100,repay amount is 1100, if(amount >= totalFee) { feeStored[_onBehalfOf] = 0; PeUSD.transferFrom(_provider, address(configurator), totalFee); PeUSD.burn(_provider, amount - totalFee); feestored will be zero, and burn 1000Peusd ,but borrowed[_onBehalfOf] -= amount; that deducted 1100 from borrowed[_onBehalfOf], that will be underflow

scenario 2 ,borrowed[_onBehalfOf] is 1000,total fee is 100. repay amount is 90.that not only deducted from totalFee, also deducted from borrowed[_onBehalfOf],it should only be deducted from totalFee. totalfee= 10, borrowed[_onBehalfOf] will be 910;it will be like that

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.

Tools Used

manual view

Recommended Mitigation Steps

if(amount >= totalFee) { feeStored[_onBehalfOf] = 0; PeUSD.transferFrom(_provider, address(configurator), totalFee); amountForBorrwed= amount -totalFee PeUSD.burn(_provider,amountForBorrwed ); } else { feeStored[_onBehalfOf] = totalFee - amount; PeUSD.transferFrom(_provider, address(configurator), amount); } try configurator.distributeRewards() {} catch {} if (amount <totalFee) revert; borrowed[_onBehalfOf] -= amountForBorrwed; poolTotalPeUSDCirculation -= amountForBorrwed;

Assessed type

Math