You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
This repository has been archived by the owner on Dec 17, 2023. It is now read-only.
sherlock-admin opened this issue
Jun 15, 2023
· 0 comments
Labels
DuplicateA valid issue that is a duplicate of an issue with `Has Duplicates` labelMediumA valid Medium severity issueRewardA payout will be made for this issue
In case, when asset balance is less than unclaimedTotal, then users will receive less amount. if (totalCollateral.lt(unclaimedTotal)) claimAmount = claimAmount.muldiv(totalCollateral, unclaimedTotal);
totalCollateral is not stale value as it's changing with every position closing and settlement. As such it's possible that sometimes totalCollateral can become less than unclaimedTotal and then in some time become bigger again.
Malicious user can wait for such events in order to claim less amount to the claimers, who didn't claim yet.
As result of this he can increase amount per share for the users who still in the vault and make losses for users, that are now claimed by him.
Impact
User;s account can be claimed not in the best time and make losses.
Code Snippet
Provided above
Tool used
Manual Review
Recommendation
Do not allow someone else to claim user's account.
Sign up for freeto subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Labels
DuplicateA valid issue that is a duplicate of an issue with `Has Duplicates` labelMediumA valid Medium severity issueRewardA payout will be made for this issue
rvierdiiev
medium
BalancedVault.claim can be called in not favorable situation
Summary
BalancedVault.claim can be called in not favorable situation to make claimer receive less.
Vulnerability Detail
BalancedVault.claim
can be called by anyone. You need to provide account, which will be claimed.https://github.com/sherlock-audit/2023-05-perennial/blob/main/perennial-mono/packages/perennial-vaults/contracts/balanced/BalancedVault.sol#L210-L228
In case, when asset balance is less than
unclaimedTotal
, then users will receive less amount.if (totalCollateral.lt(unclaimedTotal)) claimAmount = claimAmount.muldiv(totalCollateral, unclaimedTotal);
totalCollateral
is not stale value as it's changing with every position closing and settlement. As such it's possible that sometimestotalCollateral
can become less thanunclaimedTotal
and then in some time become bigger again.Malicious user can wait for such events in order to claim less amount to the claimers, who didn't claim yet.
As result of this he can increase amount per share for the users who still in the vault and make losses for users, that are now claimed by him.
Impact
User;s account can be claimed not in the best time and make losses.
Code Snippet
Provided above
Tool used
Manual Review
Recommendation
Do not allow someone else to claim user's account.
Duplicate of #174
The text was updated successfully, but these errors were encountered: