Skip to content

High: Supply share price decrease due to double rounding down in reportDeficit #1080

@mrkishorsinghpatel-dotcom

Description

Aave V4 ka core rule hai ki share price kabhi kam nahi honi chahiye. Lekin Spoke.sol aur Hub.sol dono jagah rounding down hone se deficitRay (nuksan) register ho jata hai par shares update nahi hote, jis se price gir jati hai.
​## Vulnerability Detail
Spoke.sol mein rayDivDown aur Hub.sol mein toDrawnSharesDown ka use ho raha hai. Dono jagah 1 wei debt par result 0 shares aata hai. Isse totalAddedAssets niche gir jata hai.
​## Impact // SPDX-License-Identifier: UNLICENSED
pragma solidity ^0.8.0;
import 'tests/unit/Hub/HubBase.t.sol';

contract PoCBug is HubBase {
function test_SharePriceDecrease() public {
// 1. Initial Exchange Rate check
uint256 initialRate = getAddExRate(daiAssetId);

    // 2. Dust Deficit Report (1 wei)
    // Spoke calling Hub. Rounding down in both Spoke and Hub makes shares = 0, but deficit increases.
    vm.prank(address(spoke1));
    hub1.reportDeficit(daiAssetId, 1, IHubBase.PremiumDelta(0, 0));

    // 3. Final Exchange Rate check
    uint256 finalRate = getAddExRate(daiAssetId);

    // 4. Invariant Check: Price should NOT decrease
    // If finalRate < initialRate, the core invariant is broken.
    assertGe(finalRate, initialRate, "BUG: Supply share price decreased due to rounding!");
}

}

High. Invariant violation (Price reduction).

Image

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions