Venus Prime - btk's results

Lines of code

https://github.com/code-423n4/2023-09-venus/blob/main/contracts/Tokens/Prime/Prime.sol#L537 https://github.com/code-423n4/2023-09-venus/blob/main/contracts/Tokens/Prime/Prime.sol#L507

Vulnerability details

Impact

The calculateAPR() and estimateAPR() functions currently do not apply decimal scaling to the capital value returned by _capitalForScore(). Resulting in incorrect calculations, potential integration problems, and UI issues.

Proof of Concept

The _capitalForScore() function calculate the capital for calculation of score. Every function that utilizes this value should scale it by the number of vToken decimal. The _calculateScore() function provides a correct example of this scaling, as shown below:

        (uint256 capital, , ) = _capitalForScore(xvsBalanceForScore, borrow, supply, market);
        capital = capital * (10 ** (18 - vToken.decimals()));

However, the calculateAPR() and estimateAPR() functions currently use the capital value directly, without scaling:

        (uint256 capital, uint256 cappedSupply, uint256 cappedBorrow) = _capitalForScore(
            xvsBalanceForScore,
            borrow,
            supply,
            market
        );
        uint256 userScore = Scores.calculateScore(xvsBalanceForScore, capital, alphaNumerator, alphaDenominator);

        (, uint256 cappedSupply, uint256 cappedBorrow) = _capitalForScore(
            xvsBalanceForScore,
            borrow,
            supply,
            address(vToken)
        );

        return _calculateUserAPR(market, supply, borrow, cappedSupply, cappedBorrow, userScore, totalScore);

This can potentially lead to discrepancies in calculations and issues when working with tokens that have different decimal precisions. Users and protocols interacting with the Prime might also face confusion or errors when making decisions based on these values, and UI-related problems when interacting with this view functions.

Tools Used

Manual review

Recommended Mitigation Steps

We recommend scaling the returned values like this: capital = capital * (10 ** (18 - vToken.decimals()));

Assessed type

Decimal