Perp::computeRequiredAmounts
applies the calculated offset
incorrectly, leading to incorrect amount of tokens traded
#503
Labels
2 (Med Risk)
Assets not at direct risk, but function/availability of the protocol could be impacted or leak value
bug
Something isn't working
insufficient quality report
This report is not of sufficient quality
🤖_primary
AI based primary recommendation
Lines of code
https://github.com/code-423n4/2024-05-predy/blob/main/src/libraries/Trade.sol#L45-L47
https://github.com/code-423n4/2024-05-predy/blob/main/src/libraries/Perp.sol#L462-L467
https://github.com/code-423n4/2024-05-predy/blob/main/src/libraries/Trade.sol#L84
https://github.com/code-423n4/2024-05-predy/blob/main/src/libraries/Trade.sol#L94
Vulnerability details
Impact
When trades are executed,
Perp::computeRequiredAmounts
is called to calculate therequired token amounts
that will be used in the swap.This amount is used to determine how much
base tokens
to trade with the user.Perp::computeRequiredAmounts
applies anoffset
on therequiredAmounts
for better accuracy. As mentioned by the sponsor on discord,"We remove the offset from the Uni LP and convert it to Squart."
.In addition, the Predy docs mention
"What we aim to do is to maintain Squart at 2√x by adjusting the offset during rebalances."
The problem is that the sign of the
offset
andrequiredAmounts
are not taken into account, therequiredAmounts
is always subtracted by theoffset
.The intention is that the
offset
should reduce therequiredAmounts
. However, depending on the signs of these values, it may incorrectly increase.When cases #1 and #4 occur, the
requiredAmount
is increased when it should be decreased.This will lead to an incorrect swap value for the amount of
base tokens
to trade. Users or LPs may suffer due to losing morebase tokens
on the trade.Proof of Concept
Trade.sol#L45-L47
The
required token
amounts are calculated, which are required for the token swaps for the trade.Perp.sol#L462-L467
Offsets are applied to the required token amounts to ensure they are not overestimated, which is why they are deducted.
However, the signs of
requiredAmountUnderlying
,requiredAmountStable
,offsetUnderlying
,offsetStable
can be either positive or negative.Let's view what happens in these two cases:
requiredAmount += offset
. Here, requiredAmount is increased-requiredAmount += offset
. requiredAmount is increased.In these cases, the offset increases the requiredAmount, rather than decreasing it.
The returned
requiredAmountUnderlying
is used to calculate thetotalBaseAmount
for the trade (amount of base tokens to swap). ThetotalBaseAmount
will be inflated because the offset had increased therequired amounts
.Trade.sol#L84
Which is used for the
settlement callback
Trade.sol#L94
totalBaseAmount
is the amount of base tokens to swap.During the callback, base tokens are either sold or bought in exchange for quote tokens. Since the amount of base tokens was calculated incorrectly, this swap will trade an incorrect amount of base tokens, and users/LPs may have to give up more base tokens than required, causing a loss for them.
Tools Used
Manual Review
Recommended Mitigation Steps
Apply the offset correctly, depending on the sign of the required tokens and calculated offset, for both
underlying
andstable
amounts:Assessed type
Math
The text was updated successfully, but these errors were encountered: