PoolTogether - wangxx2026's results

A protocol for no-loss prize savings

General Information

Platform: Code4rena

Start Date: 07/07/2023

Pot Size: $121,650 USDC

Total HM: 36

Participants: 111

Period: 7 days

Judge: Picodes

Total Solo HM: 13

Id: 258

League: ETH

PoolTogether

Findings Distribution

Researcher Performance

Rank: 11/111

Findings: 3

Award: $1,908.64

🌟 Selected for report: 0

🚀 Solo Findings: 0

External Links

Code4rena Contest Page Github Contest Repository Github Findings Repository PoolTogether

Findings Information

🌟 Selected for report: Aymen0909

Also found by: 0xWaitress, KupiaSec, wangxx2026

Labels

bug

3 (High Risk)

partial-50

duplicate-427

Awards

768.245 USDC - $768.25

External Links

Link to GitHub issue

Lines of code

https://github.com/GenerationSoftware/pt-v5-vault/blob/b1deb5d494c25f885c34c83f014c8a855c5e2749/src/Vault.sol#L572-L576

Vulnerability details

Impact

Unable to calculate cost correctly

Proof of Concept

The call path to get the balance

_liquidatableBalanceOf->availableYieldBalance

analyze

Through availableYieldBalance, we know that what is returned is assert not shares Through mintYieldFee, _increaseYieldFeeBalance we know that _yieldFeeTotalSupply is shares，and the parameter that _increaseYieldFeeBalance needs to pass is shares

So the assert is missing here and converted to shares

Tools Used

manual review

Recommended Mitigation Steps

Convert assert to shares by _convertToShares

if (_yieldFeePercentage != 0) {
  _increaseYieldFeeBalance(
    _convertToShares(
      (_amountOut * FEE_PRECISION) / (FEE_PRECISION - _yieldFeePercentage) - _amountOut, 
      Math.Rounding.Down
   )
  );
}

Assessed type

Error

#0 - c4-judge
2023-07-16T15:42:32Z

Picodes marked the issue as duplicate of #427

#1 - c4-judge
2023-08-05T21:47:48Z

Picodes marked the issue as satisfactory

#2 - c4-judge
2023-08-05T21:48:00Z

Picodes marked the issue as partial-50

#3 - Picodes
2023-08-05T21:48:50Z

Partial credit due to the report's low quality

Findings Information

🌟 Selected for report: Aymen0909

Also found by: 0xWaitress, KupiaSec, wangxx2026

Labels

bug

3 (High Risk)

satisfactory

duplicate-427

Awards

768.245 USDC - $768.25

External Links

Link to GitHub issue

Lines of code

https://github.com/GenerationSoftware/pt-v5-vault/blob/b1deb5d494c25f885c34c83f014c8a855c5e2749/src/Vault.sol#L584

Vulnerability details

Impact

The shares parameter passed to _mint is assets not shares, resulting in data confusion

Proof of Concept

_mint's code

https://github.com/GenerationSoftware/pt-v5-vault/blob/b1deb5d494c25f885c34c83f014c8a855c5e2749/src/Vault.sol#L1122-L1127

_mint declaration

function _mint(address _receiver, uint256 _shares) internal virtual override;

Application of _amountOut

https://github.com/GenerationSoftware/pt-v5-vault/blob/b1deb5d494c25f885c34c83f014c8a855c5e2749/src/Vault.sol#L566-L568C5

https://github.com/GenerationSoftware/pt-v5-vault/blob/b1deb5d494c25f885c34c83f014c8a855c5e2749/src/Vault.sol#L580-L582

In short

_amountOut is assets, _mint needs shares, _amountOut needs to be converted to shares

Tools Used

Recommended Mitigation Steps

change from

_mint(_account, _amountOut);

_mint(_account, _convertToShares(_amountOut, Math.Rounding.Down));

Assessed type

Error

#0 - c4-judge
2023-07-14T22:42:49Z

Picodes marked the issue as duplicate of #5

#1 - c4-judge
2023-08-05T21:47:36Z

Picodes marked the issue as satisfactory

Findings Information

🌟 Selected for report: Udsen

Also found by: 0xMirce, 0xPsuedoPandit, 0xStalin, 0xbepresent, Aymen0909, Bobface, Co0nan, GREY-HAWK-REACH, Jeiwan, John, KupiaSec, LuchoLeonel1, Nyx, Praise, RedTiger, alexweb3, bin2chen, btk, dacian, dirk_y, josephdara, keccak123, ktg, mahdirostami, markus_ether, minhtrng, ni8mare, peanuts, ptsanev, ravikiranweb3, rvierdiiev, seeques, serial-coder, shaka, teawaterwire, wangxx2026, zzzitron

Awards

2.2492 USDC - $2.25

Labels

bug

3 (High Risk)

satisfactory

edited-by-warden

duplicate-396

External Links

Link to GitHub issue

Lines of code

https://github.com/GenerationSoftware/pt-v5-vault/blob/b1deb5d494c25f885c34c83f014c8a855c5e2749/src/Vault.sol#L394-L402

Vulnerability details

Impact

Anyone can get _yieldFeeTotalSupply

Proof of Concept

Get shares after calling mintYieldFee, and then withdraw through withdraw() without any other restrictions in between

Tools Used

manual review

Recommended Mitigation Steps

should add modifier onlyOwner

Assessed type

Access Control

#0 - c4-judge
2023-07-14T22:22:23Z

Picodes marked the issue as duplicate of #396

#1 - c4-judge
2023-08-05T22:03:59Z

Picodes marked the issue as satisfactory

Findings Information

🌟 Selected for report: RedTiger

Also found by: wangxx2026, zzzitron

Labels

bug

3 (High Risk)

satisfactory

edited-by-warden

duplicate-190

Awards

1138.1408 USDC - $1,138.14

External Links

Link to GitHub issue

Lines of code

https://github.com/GenerationSoftware/pt-v5-vault/blob/b1deb5d494c25f885c34c83f014c8a855c5e2749/src/Vault.sol#L394-L402

Vulnerability details

Impact

would lead to undercollateralization

Proof of Concept

The under-mortgage check should be placed after _mint, because _mint will affect the mortgage. If it is placed before, it will lead to the introduction of under-mortgage after _mint

_requireVaultCollateralized call path

_requireVaultCollateralized->_isVaultCollateralized->_currentExchangeRate

_mint call path

_mint->_updateExchangeRate->_currentExchangeRate

In Short

We missed post-execution mortgage checks

Tools Used

manual review

Recommended Mitigation Steps

Call _requireVaultCollateralized after _mint function mintYieldFee(uint256 _shares, address _recipient) external {

if (_shares > _yieldFeeTotalSupply) revert YieldFeeGTAvailable(_shares, _yieldFeeTotalSupply);

_yieldFeeTotalSupply -= _shares;
_mint(_recipient, _shares);
_requireVaultCollateralized();
emit MintYieldFee(msg.sender, _recipient, _shares);

}

Assessed type

Invalid Validation

#0 - c4-judge
2023-07-18T19:50:59Z

Picodes marked the issue as duplicate of #307

#1 - c4-judge
2023-08-06T10:55:25Z

Picodes marked the issue as satisfactory

PoolTogether - wangxx2026's results

A protocol for no-loss prize savings

General Information

Findings Distribution

Researcher Performance

External Links

[H-03] Assets are not converted to shares when calculating fees - $768.25

Findings Information

Labels

Awards

External Links

Lines of code

Vulnerability details

Impact

Proof of Concept

The call path to get the balance

analyze

Tools Used

Recommended Mitigation Steps

Assessed type

#0 - c4-judge2023-07-16T15:42:32Z

#1 - c4-judge2023-08-05T21:47:48Z

#2 - c4-judge2023-08-05T21:48:00Z

#3 - Picodes2023-08-05T21:48:50Z

[H-03] When _mint is called in liquidate, the asset is not converted to shares - $768.25

Findings Information

Labels

Awards

External Links

Lines of code

Vulnerability details

Impact

Proof of Concept

_mint's code

_mint declaration

Application of _amountOut

In short

Tools Used

Recommended Mitigation Steps

Assessed type

#0 - c4-judge2023-07-14T22:42:49Z

#1 - c4-judge2023-08-05T21:47:36Z

[H-04] mintYieldFee method does not have permission to judge - $2.25

Findings Information

Awards

Labels

External Links

Lines of code

Vulnerability details

Impact

Proof of Concept

Tools Used

Recommended Mitigation Steps

Assessed type

#0 - c4-judge2023-07-14T22:22:23Z

#1 - c4-judge2023-08-05T22:03:59Z

[H-07] mintYieldFee invalid judgment - $1,138.14

Findings Information

Labels

Awards

External Links

Lines of code

Vulnerability details

Impact

Proof of Concept

_requireVaultCollateralized call path

_mint call path

In Short

Tools Used

Recommended Mitigation Steps

Assessed type

#0 - c4-judge2023-07-18T19:50:59Z

#1 - c4-judge2023-08-06T10:55:25Z

#0 - c4-judge
2023-07-16T15:42:32Z

#1 - c4-judge
2023-08-05T21:47:48Z

#2 - c4-judge
2023-08-05T21:48:00Z

#3 - Picodes
2023-08-05T21:48:50Z

#0 - c4-judge
2023-07-14T22:42:49Z

#1 - c4-judge
2023-08-05T21:47:36Z

#0 - c4-judge
2023-07-14T22:22:23Z

#1 - c4-judge
2023-08-05T22:03:59Z

#0 - c4-judge
2023-07-18T19:50:59Z

#1 - c4-judge
2023-08-06T10:55:25Z