Skip to content

Conversation

@nicholaspai
Copy link
Member

@nicholaspai nicholaspai commented Mar 15, 2022

Issue:

  • [L05] Liquidity provisioning can skew fee assessments
    • In the HubPool contract the enableL1TokenForLiquidityProvision function allows the contract
      owner to enable an l1token to be added to the protocol for liquidity pooling.
    • This is allowed even if the l1token is already currently enabled.
    • As this function also sets the lastLpFeeUpdate variable to the then-current block.timestamp,
      enabling an already enabled token will skip over the period of time since lastLpFeeUpdate was last
      set. As a result, any LP fees that should have been assessed for that time period would simply never be
      assessed.
    • Consider reverting if this function is called for an l1token that is already enabled.

Solution:

  • Only set lastLpFeeUpdate upon first enabling

@nicholaspai nicholaspai added the OZ Audit - March Resolves issue discovered in March 2022 OZ Audit label Mar 15, 2022
Copy link
Contributor

@mrice32 mrice32 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

@nicholaspai nicholaspai changed the title fix: [L05] Liquidity provisioning should revert if token already enabled fix: [L05] Enabling token for Liquidity provisioning should not reset lastLpFeeUpdate Mar 15, 2022
@nicholaspai nicholaspai merged commit 87c6a3e into master Mar 15, 2022
@nicholaspai nicholaspai deleted the npai/liquidity-privision branch March 15, 2022 17:17
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

OZ Audit - March Resolves issue discovered in March 2022 OZ Audit

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants