deposit() afterDeposit calculation formula is incorrect. #29
Description
Lines of code
Vulnerability details
Vulnerability details
in Vault.deposit()
We will limit the user's maximum deposit cannot exceed settings().getMaxDepositInETH().
function deposit(
address receiver
)
external
payable
override
nonReentrant
whenNotPaused
onlyWhiteListed
returns (uint256 shares)
{
if (msg.value == 0) revert InvalidDepositAmount();
uint256 maxPriceAge = settings().getPriceMaxAge();
Rebase memory total = Rebase(_totalAssets(maxPriceAge), totalSupply());
if (
// Or the Rebase is unititialized
!((total.elastic == 0 && total.base == 0) ||
// Or Both are positive
(total.base > 0 && total.elastic > 0))
) revert InvalidAssetsState();
// Verify if the Deposit Value exceeds the maximum per wallet
uint256 maxDeposit = settings().getMaxDepositInETH();
if (maxDeposit > 0) {
uint256 afterDeposit = msg.value +
@> ((balanceOf(msg.sender) * _tokenPerETH(maxPriceAge)) / 1e18);
if (afterDeposit > maxDeposit) revert MaxDepositReached();
}
....
function _tokenPerETH(uint256 priceMaxAge) internal view returns (uint256) {
uint256 position = _totalAssets(priceMaxAge);
if (totalSupply() == 0 || position == 0) {
return 1 ether;
}
@> return (totalSupply() * 1 ether) / position;
}The code above uses (balanceOf(msg.sender) * _tokenPerETH(maxPriceAge) / 1e18 to calculate the current ETH deposit.
Based on the definition of the _tokenPerETH() method, this formula is incorrect.
It should be balanceOf(msg.sender) * 1e18 / _tokenPerETH(maxPriceAge).
Impact
An incorrect calculation formula can result in exceeding getMaxDepositInETH or prematurely triggering a MaxDepositReached revert.
users may not be able to deposit properly.
Recommended Mitigation
function deposit(
address receiver
)
...
// Verify if the Deposit Value exceeds the maximum per wallet
uint256 maxDeposit = settings().getMaxDepositInETH();
if (maxDeposit > 0) {
uint256 afterDeposit = msg.value +
- ((balanceOf(msg.sender) * _tokenPerETH(maxPriceAge)) / 1e18);
+ ((balanceOf(msg.sender) * 1e18) / _tokenPerETH(maxPriceAge));
if (afterDeposit > maxDeposit) revert MaxDepositReached();
}Assessed type
Context