Revolution Protocol - haxatron's results

Lines of code

https://github.com/code-423n4/2023-12-revolutionprotocol/blob/main/packages/revolution/src/ERC20TokenEmitter.sol#L179

Vulnerability details

Impact

https://github.com/code-423n4/2023-12-revolutionprotocol/blob/main/packages/revolution/src/ERC20TokenEmitter.sol#L179

In lines 179-188, the following sequence of events occur

1. Obtain token amount to pay creators
2. Obtain token amount to pay buyers
3. Update emittedTokenWad with token amount paid to buyers
4. Update emittedTokenWad with token amount paid to creators

The emittedTokenWad is the amount sold so far is used to track x_start of VRGDAC, therefore, the same x_start values when obtaining the amount to pay buyers and creators instead of updating the x_start values after paying the creator before calculating the buyers.

Therefore, more tokens are emitted than the intended amount due to the lower intended x_start value. We can use https://www.desmos.com/calculator/im67z1tate to verify that lower x_start values will lead to higher token emittance.

Given x_start of 100, Y_toX(50) = 35.9 tokens emitted Given x_start of 50, Y_toX(50) = 54.6 tokens emitted

In general lower x_start values lead to higher tokens emitted this will lead to the protocol not following intended issuance schedule. This leads to loss of funds from the missed out sales of the tokens for the protocol as it issues more tokens than intended. The impact is greater the lower the initial x_start value.

Tools Used

Manual Review

Recommended Mitigation Steps

The following is the correct sequence of events:

1. Obtain token amount to pay creators
2. Update emittedTokenWad with token amount paid to creators
3. Obtain token amount to pay buyers
4. Update emittedTokenWad with token amount paid to buyers

Assessed type

Other