Platform: Code4rena
Start Date: 21/06/2022
Pot Size: $50,000 USDC
Total HM: 31
Participants: 99
Period: 5 days
Judges: moose-code, JasoonS, denhampreen
Total Solo HM: 17
Id: 139
League: ETH
Rank: 82/99
Findings: 1
Award: $53.14
🌟 Selected for report: 0
🚀 Solo Findings: 0
🌟 Selected for report: IllIllI
Also found by: 0x1337, 0x1f8b, 0x29A, 0x52, 0xDjango, 0xNazgul, 0xNineDec, 0xc0ffEE, 0xf15ers, 0xmint, Bnke0x0, BowTiedWardens, Chom, ElKu, FudgyDRS, Funen, GalloDaSballo, GimelSec, JC, Kaiziron, Lambda, Limbooo, Metatron, MiloTruck, Noah3o6, Picodes, PumpkingWok, PwnedNoMore, Sm4rty, StErMi, TomJ, TrungOre, UnusualTurtle, Waze, _Adam, aga7hokakological, ak1, antonttc, berndartmueller, cccz, cryptphi, csanuragjain, defsec, delfin454000, dipp, elprofesor, exd0tpy, fatherOfBlocks, hake, hansfriese, hubble, joestakey, kenta, ladboy233, mics, oyc_109, pashov, pedr02b2, reassor, robee, samruna, scaraven, shung, sikorico, simon135, sseefried, tchkvsky, unforgiven, zzzitron
53.1414 USDC - $53.14
At every rebase() the Yieldy.sol pushes a new Rebase structure into the rebases. Within the parameters it stores the totalStakedBefore as _previousCirculation and totalStakedAfter as _totalSupply but it seems they represent the same amount. The rebase() function internally calls the _storeRebase , if the profit is > 0, passing the updatedTotalSupply as _previousCirculation (line 100) but at line 98 the same value is used to update the _totalSupply, so at time of creating and push a new Rebase, both totalStakeBefore and totalStakedAfter will be defined with the same value.
To resolve this, if the _previousCirculation needs to represent the total supply before updating it, the currentTotalSupply (line 82) can be passed as first parameter in _storeRebase() call instead of updatedTotalSupply.