Different formulas to calculate tokenAmount

[code423n4]

Handle

gpersoon

Vulnerability details

Impact

The function joinPool() and calcTokensForAmount() both calculate the tokenAmount , taking in account the entryFee.
However both use a different formula.
The result of the formulas is the same as far as I can see.
However for maintenance purposes it is better to use the same formula.

Note1: exitPool() and calcTokensForAmountExit() do use the same formula.
Note2: When using the same formula it is easier to optimize for gas, for example to take "_amount.add(feeAmount)" outside of the for loop.

Proof of Concept

https://github.com/code-423n4/2021-12-amun/blob/cf890dedf2e43ec787e8e5df65726316fda134a1/contracts/basket/contracts/facets/Basket/BasketFacet.sol#L143-L185

function joinPool(uint256 _amount, uint16 _referral)  external override noReentry {
       ...
        uint256 feeAmount = _amount.mul(bs.entryFee).div(10**18);
        for (uint256 i; i < bs.tokens.length; i++) {
            IERC20 token = bs.tokens[i];
            uint256 tokenAmount =  balance(address(token)).mul(_amount.add(feeAmount)).div( totalSupply );

https://github.com/code-423n4/2021-12-amun/blob/cf890dedf2e43ec787e8e5df65726316fda134a1/contracts/basket/contracts/facets/Basket/BasketFacet.sol#L332-L362

 function calcTokensForAmount(uint256 _amount)  external view  override returns (address[] memory tokens, uint256[] memory amounts) {
...
        for (uint256 i; i < bs.tokens.length; i++) {
            IERC20 token = bs.tokens[i];
            uint256 tokenBalance = balance(address(token));
            uint256 tokenAmount = tokenBalance.mul(_amount).div(totalSupply);
            tokenAmount = tokenAmount.add(  tokenAmount.mul(bs.entryFee).div(10**18)  );

Tools Used

Recommended Mitigation Steps

In function calcTokensForAmount() use the same formula to calculate tokenAmount as in joinPool()