xiaoming90 - Residual amount is not refunded

[sherlock-admin]

xiaoming90

high

Residual amount is not refunded

Summary

The residual amount will not be refunded back to the account.

Vulnerability Detail

https://github.com/sherlock-audit/2023-03-notional/blob/main/contracts-v2/contracts/internal/vaults/VaultAccount.sol#L571

File: VaultAccount.sol
567:             if (netPrimeDebtRepaid < accountPrimeStorageValue) {
568:                 // If the net debt change is greater than the debt held by the account, then only
569:                 // decrease the total prime debt by what is held by the account. The residual amount
570:                 // will be refunded to the account via a direct transfer.
571:                 netPrimeDebtChange = accountPrimeStorageValue;
572:                 finalPrimeDebtStorageValue = 0;
573: 
574:                 int256 primeCashRefund = pr.convertFromUnderlying(
575:                     pr.convertDebtStorageToUnderlying(netPrimeDebtChange.sub(accountPrimeStorageValue))
576:                 );
577:                 TokenHandler.withdrawPrimeCash(
578:                     account, currencyId, primeCashRefund, pr, false // ETH will be transferred natively
579:                 );
580:                 didTransfer = true;
581:             } else {

Let $a$ be accountPrimeStorageValue. In Line 571, netPrimeDebtChange is set to $a$.

In Line 575, netPrimeDebtChange.sub(accountPrimeStorageValue) is equivalent to $a - a$. For any number a, the result of subtracting $a$ from itself always equals zero. As a result, primeCashRefund will also always be zero after the conversion.

Impact

Loss of assets for the users as the residual amount will not be refunded back to the account.

Code Snippet

https://github.com/sherlock-audit/2023-03-notional/blob/main/contracts-v2/contracts/internal/vaults/VaultAccount.sol#L571

Tool used

Manual Review

Recommendation

It is recommended to implement the following change:

int256 primeCashRefund = pr.convertFromUnderlying(
-    pr.convertDebtStorageToUnderlying(netPrimeDebtChange.sub(accountPrimeStorageValue))
+    pr.convertDebtStorageToUnderlying(netPrimeDebtRepaid.sub(accountPrimeStorageValue))
);

Duplicate of #172