Centrifuge - ether_sky's results

Lines of code

https://github.com/code-423n4/2023-09-centrifuge/blob/512e7a71ebd9ae76384f837204216f26380c9f91/src/InvestmentManager.sol#L248-L251 https://github.com/code-423n4/2023-09-centrifuge/blob/512e7a71ebd9ae76384f837204216f26380c9f91/src/InvestmentManager.sol#L427-L441 https://github.com/code-423n4/2023-09-centrifuge/blob/512e7a71ebd9ae76384f837204216f26380c9f91/src/InvestmentManager.sol#L579-L581 https://github.com/code-423n4/2023-09-centrifuge/blob/512e7a71ebd9ae76384f837204216f26380c9f91/src/InvestmentManager.sol#L598-L600 https://github.com/code-423n4/2023-09-centrifuge/blob/512e7a71ebd9ae76384f837204216f26380c9f91/src/InvestmentManager.sol#L474-L477

Vulnerability details

Impact

When a user attempts to process a deposit, more tranche tokens than maxMint may be sent to that user. If there are not enough tranche tokens in 'escrow', the transaction may be cancelled.

Proof of Concept

X: amount of asset token(LP currency) (maxDeposit) Y: amount of tranche token (maxMint) Price(our calculation) <= X / Y (due to rounding) So when a user attempts to process a deposit with his whole maxDeposit, required amount of 'tranch token' = X / Price >= X / (X / Y) = Y

Let me take example. Let's assume that currencyDecimals = 18, trancheTokenDecimals = 18. And a user requested deposit with 1 * 10 ^ 18 assets. In the next epoch, a user received message from Centrifuge and inside handleExecutedCollectInvest() function, his maxDeposit and maxMint were increased and let's suppose that he received currencyPayout = 1 * 10 ^ 18, trancheTokensPayout = 3 * 10 ^ 18

lpValues.maxDeposit = lpValues.maxDeposit + currencyPayout;
lpValues.maxMint = lpValues.maxMint + trancheTokensPayout;
LiquidityPoolLike(liquidityPool).mint(address(escrow), trancheTokensPayout);

And 3 * 10 ^ 18 tranche tokens was minted to escrow. That user wanted to process deposit with his whole maxDepsit (1 * 10 ^ 18 in this case). In _calculatePrice() function,

depositPrice = currencyAmountInPriceDecimals.mulDiv(
   10 ** PRICE_DECIMALS, trancheTokenAmountInPriceDecimals, MathLib.Rounding.Down
) = 1 * 10 ^ 18 * 10 ^ 18 / (3 * 10 ^ 18) = 333,333,333,333,333,333

In _calculateTrancheTokenAmount() function,

uint256 currencyAmountInPriceDecimals = _toPriceDecimals(currencyAmount, currencyDecimals, 
    liquidityPool).mulDiv(10 ** PRICE_DECIMALS, price, MathLib.Rounding.Down) = 1 * 10 ^ 18 * 10 ^ 18 / 333,333,333,333,333,333 = 3,000,000,000,000,000,003

This value is larger than maxMint = 3 * 10 ^ 18. If escrow has not enough tranche token, user couldn't process deposit.

Tools Used

Manual audit https://www.calculator.net/big-number-calculator.html (for calculation)

Recommended Mitigation Steps

In _deposit() function, we can select smaller value between maxMint and trancheTokenAmount.

Assessed type

Error