Ethos Reserve contest - jasonxiale's results

Lines of code

https://github.com/code-423n4/2023-02-ethos/blob/73687f32b934c9d697b97745356cdf8a1f264955/Ethos-Vault/contracts/ReaperVaultV2.sol#L359-L412

Vulnerability details

Impact

Function ReaperVaultV2._withdraw first call _burn to burn depositor's share, then call token.safeTransfer to transfer value of token to msg.sender, however there are some cases that value doesn't conform with _shares, which cause depositor's loss

Proof of Concept

if (value > token.balanceOf(address(this))), the vault first checks if balanceOf(this) is larger than value, if not, the vault will withdraw token from withdrawQueue. After that, the vault will check again, if the vault's balance is still smaller than value, it will change value to it's current balance, in such case, vault _burn more share than it sends to depositor

Say depositor calls withdraw with _shares equaling to 100, in line365 the value is 10000, and in line366, vault burns depositor 100 shares Then the Vault doesn't have enough token, so it withdraws token from its strategies After that, it get 1000 as vaultBalance, in such case, value is set to vaultBalance in line401 Finally, line410 will transfer 1000 token to depositor, but in the beginning of the function, the Vault burn more shares.

Tools Used

Manually

Recommended Mitigation Steps

recalculate and burn share according to how much token are sent to depositor