-
Notifications
You must be signed in to change notification settings - Fork 9
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Sherlock fix https://github.com/sherlock-audit/2023-03-Y2K-judging/issues/163 #125
Conversation
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Needs additional changes. This will revert if diff is too high due to underflow in L412
@IAm0x52 position is validated to be in profit at this poiunt, meaning that |
src/v2/Carousel/Carousel.sol
Outdated
// skip the rollover for the user if the assets cannot cover the relayer fee instead of revert. | ||
if (queue[index].assets < relayerFee) { | ||
index++; | ||
continue; | ||
} | ||
|
||
uint256 originalDepositValue = queue[index].assets - diffInAssets; |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@3xHarry Highly profitable epochs could underflow here since diffInAssets can be greater than queue[index].assets. I.e. entitled amount = 200 and assets = 99. diff = 101 and 99 - 101 will underflow. That edge case would break rollover functionality. Mitigation would be complex so maybe better to just acknowledge and accept the risk
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
@IAm0x52 issues does not exist in later PR, see permalink:
Earthquake/src/v2/Carousel/Carousel.sol
Lines 422 to 426 in 5cb2890
uint256 originalDepositValue = queue[index].shares - | |
previewAmountInShares( | |
queue[index].epochId, | |
(entitledAmount - queue[index].shares) // subtract profit from share value | |
); |
Here i convert profit in nominal terms back to shares which is lower than nominal terms of entitledAmount
shares
== entitledAmount
No description provided.