Skip to content

Commit

Permalink
fix(contract): remove shares exploit fix
Browse files Browse the repository at this point in the history
  • Loading branch information
PierrickGT committed Jul 6, 2022
1 parent 8928715 commit 555a620
Show file tree
Hide file tree
Showing 2 changed files with 5 additions and 8 deletions.
11 changes: 4 additions & 7 deletions contracts/yield-source/ATokenYieldSource.sol
Expand Up @@ -229,11 +229,10 @@ contract ATokenYieldSource is ERC20, IProtocolYieldSource, Manageable, Reentranc
uint256 shares = _tokenToShares(mintAmount);
_requireSharesGTZero(shares);

uint256 tokenAmount = _sharesToToken(shares);
_depositToAave(tokenAmount);
_depositToAave(mintAmount);
_mint(to, shares);

emit SuppliedTokenTo(msg.sender, shares, tokenAmount, to);
emit SuppliedTokenTo(msg.sender, shares, mintAmount, to);
}

/// @notice Redeems asset tokens from the yield source
Expand All @@ -245,19 +244,17 @@ contract ATokenYieldSource is ERC20, IProtocolYieldSource, Manageable, Reentranc
uint256 shares = _tokenToShares(redeemAmount);
_requireSharesGTZero(shares);

uint256 tokenAmount = _sharesToToken(shares);

_burn(msg.sender, shares);

IERC20 _depositToken = IERC20(_tokenAddress);
uint256 beforeBalance = _depositToken.balanceOf(address(this));
_lendingPool().withdraw(_tokenAddress, tokenAmount, address(this));
_lendingPool().withdraw(_tokenAddress, redeemAmount, address(this));
uint256 afterBalance = _depositToken.balanceOf(address(this));

uint256 balanceDiff = afterBalance.sub(beforeBalance);
_depositToken.safeTransfer(msg.sender, balanceDiff);

emit RedeemedToken(msg.sender, shares, tokenAmount);
emit RedeemedToken(msg.sender, shares, redeemAmount);
return balanceDiff;
}

Expand Down
2 changes: 1 addition & 1 deletion test/ATokenYieldSource.test.ts
Expand Up @@ -497,7 +497,7 @@ describe('ATokenYieldSource', () => {
).to.be.revertedWith('ATokenYieldSource/shares-gt-zero');
});

it('should succeed to manipulate share price but fail to redeem more than deposited', async () => {
it.skip('should succeed to manipulate share price but fail to redeem more than deposited', async () => {
const amount = toWei('100000');
const attackAmount = BigNumber.from(1);
const aTokenAmount = toWei('10000');
Expand Down

0 comments on commit 555a620

Please sign in to comment.