-
Notifications
You must be signed in to change notification settings - Fork 34
Open
Description
Aave V4 ka core rule hai ki share price kabhi kam nahi honi chahiye. Lekin Spoke.sol aur Hub.sol dono jagah rounding down hone se deficitRay (nuksan) register ho jata hai par shares update nahi hote, jis se price gir jati hai.
## Vulnerability Detail
Spoke.sol mein rayDivDown aur Hub.sol mein toDrawnSharesDown ka use ho raha hai. Dono jagah 1 wei debt par result 0 shares aata hai. Isse totalAddedAssets niche gir jata hai.
## Impact // SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.0;
import 'tests/unit/Hub/HubBase.t.sol';
contract PoCBug is HubBase {
function test_SharePriceDecrease() public {
// 1. Initial Exchange Rate check
uint256 initialRate = getAddExRate(daiAssetId);
// 2. Dust Deficit Report (1 wei)
// Spoke calling Hub. Rounding down in both Spoke and Hub makes shares = 0, but deficit increases.
vm.prank(address(spoke1));
hub1.reportDeficit(daiAssetId, 1, IHubBase.PremiumDelta(0, 0));
// 3. Final Exchange Rate check
uint256 finalRate = getAddExRate(daiAssetId);
// 4. Invariant Check: Price should NOT decrease
// If finalRate < initialRate, the core invariant is broken.
assertGe(finalRate, initialRate, "BUG: Supply share price decreased due to rounding!");
}
}
High. Invariant violation (Price reduction).

Metadata
Metadata
Assignees
Labels
No labels