Skip to content
This repository was archived by the owner on Jul 15, 2024. It is now read-only.
This repository was archived by the owner on Jul 15, 2024. It is now read-only.

Losing 1 share worth of assets upon deposit #22

@MichaelMorami

Description

@MichaelMorami

deposit function allows a user to call it with a certain amount of assets, end up transferring more than that amount, and get 1 less share in return.
An example can be seen here (report)

Summary:

Suppose the user calls the deposit function with an asset amount equivalent to anywhere in the range [x.5, x+1) AToken. In that case, the deposit function will round up the amount of Atokens that needs to be transferred from the sender but will round down the number of staticAToken shares the receiver gets in return, i.e. the user send x+1 Atokens, but receive only x staticAtokens.

Detailed Scenario:

  1. User calls deposit function with an asset amount of 9 underlying tokens. The fromUnderlying flag is false so the AToken.transferFrom function is called.

  2. AToken.transferFrom function eventually calls AToken._transfer function. This function converts the user specified underlying asset amount to the number of ATokens by calling the rayDiv function with the current rate and asset amount.

  3. Due to round-up, rayDiv returns 1 AToken, which is equivalent to 18 underlying tokens.

  4. 1 AToken is transferred from the user to the staticAToken contract.

  5. Deposit function proceeds to calculate the shares to be minted to the user. rayDivRoundDown is called with the rate and the asset amount (9). Due to round-down, rayDivRoundDown returns 0.

  6. User gets 0 shares in return for the 1 AToken deposited in the vault.

Metadata

Metadata

Assignees

Labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions