0x37 - Later LP holders can get one part of previous LP holders' borrowing fee

[sherlock-admin2]

0x37

Medium

Later LP holders can get one part of previous LP holders' borrowing fee

Summary

Later LP holders can get one part of previous LP holders' borrowing fee because of the improper share price calculation.

Vulnerability Detail

When someone wants to mint some shares in one market, share's price will be calculated based on current total reserve's value and total supply.
LP holders will get some borrowing fees if traders open positions with leverage. When users close their positions, they will pay their borrowing fees and increase the share's price.
The problem is that when one LP wants to mint some shares, current total_reserves does not involve unrealized borrowing fees. This will cause new LP holders can mint shares via one cheaper share price than expected. They will share one part of borrowing fee which is generated before they mint shares.

@external
@view
def calc_mint(
  id          : uint256,
  base_amt    : uint256,
  quote_amt   : uint256,
  total_supply: uint256,
  ctx         : Ctx) -> uint256:
  pv: uint256 = self.MATH.value(Pools(self).total_reserves(id), ctx).total_as_quote
  mv: uint256 = self.MATH.value(Tokens({base: base_amt, quote: quote_amt}), ctx).total_as_quote
  return Pools(self).f(mv, pv, total_supply)

Impact

Later LP holders can get one part of previous LP holders' borrowing fee because of the improper share price calculation.

Code Snippet

https://github.com/sherlock-audit/2024-08-velar-artha/blob/main/gl-sherlock/contracts/core.vy#L154-L188

Tool used

Manual Review

Recommendation

When we calculate the share's price, add the unrealized accured borrowing fee into current reserve.

Duplicate of #50