Lybra Finance - mahdikarimi's results

Lines of code

https://github.com/code-423n4/2023-06-lybra/blob/7b73ef2fbb542b569e182d9abf79be643ca883ee/contracts/lybra/pools/base/LybraPeUSDVaultBase.sol#L206

Vulnerability details

Impact

Users don't pay fee for minted PeUSD

Vulnerability Details

wrong implementation of _repay function causes paid fee being considered as repaid debt .

if(amount >= totalFee) {
            feeStored[_onBehalfOf] = 0;
            PeUSD.transferFrom(_provider, address(configurator), totalFee);
            PeUSD.burn(_provider, amount - totalFee);
        } else {
            feeStored[_onBehalfOf] = totalFee - amount;
            PeUSD.transferFrom(_provider, address(configurator), amount);
        }
try configurator.distributeRewards() {} catch {}
borrowed[_onBehalfOf] -= amount;
poolTotalPeUSDCirculation -= amount;

Proof of Concept

Let's say alice should repay 100 PeUSD as debt and 10 peUSD as fee so she needs to repay 110 PeUSD in total however when she repays 20 PeUSD the debt related to fee will be zero ( transfer 10 PeUSD to rewardPool ) and 10 PeUSD will be burned but at the end the 20 PeUSD will be deducted from the debt while the 10 PeUSD should be deducted since 10 PeUSD was paid for fee . borrowed[_onBehalfOf] -= amount;

Tools Used

Manual Review

Recommended Mitigation Steps

Instead use this line of code borrowed[_onBehalfOf] -= amount - totalFee;

Assessed type

Other

Lines of code

https://github.com/code-423n4/2023-06-lybra/blob/7b73ef2fbb542b569e182d9abf79be643ca883ee/contracts/lybra/pools/base/LybraPeUSDVaultBase.sol#L207 https://github.com/code-423n4/2023-06-lybra/blob/7b73ef2fbb542b569e182d9abf79be643ca883ee/contracts/lybra/pools/base/LybraEUSDVaultBase.sol#L284

Vulnerability details

Impact

poolTotalEUSDCirculation calculated incorerctly so it can effect reward distribution

Proof of Concept

The following line of code deduces repaid amount from poolTotalEUSDCirculation while the fee that is part of repaid amount will be distribute as rewards and won't be burned . This also happens for poolTotalPeUSDCirculation . poolTotalEUSDCirculation -= amount;

Tools Used

Manual Review

Recommended Mitigation Steps

Instead use poolTotalEUSDCirculation -= amount;

Assessed type

Other