Revolution Protocol - rouhsamad's results

Lines of code

https://github.com/code-423n4/2023-12-revolutionprotocol/blob/main/packages/revolution/src/ERC20TokenEmitter.sol#L187-L188

Vulnerability details

Impact

in buyToken function of ERC20TokenEmitter, a percentage of msg.value is used to mint tokens for creator and remaining amount will be used to mint tokens for buyers, however, the amount of tokens to be minted for buyers is calculated in a wrong way, because the tokens which were minted for creator (totalTokensForCreators) are not added to emittedTokenWad before calculating totalTokensForBuyers (tokens that are going to be minted for buyers), this wrong accounting of sold tokens results in exponential increase in price as noted in the documentation: Basically, a VRGDA contract dynamically adjusts the price of a token to adhere to a specific issuance schedule. If the emission is ahead of schedule, the price increases exponentially. If it is behind schedule, the price of each token decreases by some constant decay rate.

Proof of Concept

as you can see in below section of buyToken function, totalTokensForCreators should be added to emittedTokenWad before calculating totalTokensForBuyers

    //@audit Direct ETH for sending to creator
    uint256 creatorDirectPayment = ((msgValueRemaining - toPayTreasury) * entropyRateBps) / 10_000;

    //@audit tokens calculated for creator
    int totalTokensForCreators = ((msgValueRemaining - toPayTreasury) - creatorDirectPayment) > 0
        ? getTokenQuoteForEther((msgValueRemaining - toPayTreasury) - creatorDirectPayment)
        : int(0);

    //@audit tokens calculated for buyers, however, totalTokensForCreators is not added to emittedTokenWad
    int totalTokensForBuyers = toPayTreasury > 0 ? getTokenQuoteForEther(toPayTreasury) : int(0);

    // Transfer ETH to treasury and update emitted
    emittedTokenWad += totalTokensForBuyers;
    if (totalTokensForCreators > 0) emittedTokenWad += totalTokensForCreators;

Tools Used

Manual review

Recommended Mitigation Steps

its suggested to put this line: if (totalTokensForCreators > 0) emittedTokenWad += totalTokensForCreators; before: int totalTokensForBuyers = toPayTreasury > 0 ? getTokenQuoteForEther(toPayTreasury) : int(0);

Assessed type

Math