Skip to content

Latest commit

 

History

History
60 lines (36 loc) · 2.28 KB

052.md

File metadata and controls

60 lines (36 loc) · 2.28 KB

Dandy Caramel Tortoise

Medium

Sudden drop/increase in share value allows users who monitor to gain at the expense of the others

Summary

Sudden drop/increase in share value allows users who monitor to gain at the expense of the others

Root Cause

The pools value is calculated as:

https://github.com/sherlock-audit/2024-11-teller-finance-update/blob/0c8535728f97d37a4052d2a25909d28db886a422/teller-protocol-v2-audit-2024/packages/contracts/contracts/LenderCommitmentForwarder/extensions/LenderCommitmentGroup/LenderCommitmentGroup_Smart.sol#L430-L440

    function getPoolTotalEstimatedValue()
        public
        view
        returns (uint256 poolTotalEstimatedValue_)
    {
       
         int256 poolTotalEstimatedValueSigned = int256(totalPrincipalTokensCommitted) 
         + int256(totalInterestCollected)  + int256(tokenDifferenceFromLiquidations) 
         - int256(totalPrincipalTokensWithdrawn);


        //if the poolTotalEstimatedValue_ is less than 0, we treat it as 0.

There are multiple reasons why the pools share value can sharply increase/decrease:

  1. The possible value of tokenDifferenceFromLiquidations for an auction ranges from (764% * amountDue , -amountDue) and is updated when the dutch auction for the collateral liquidation settles. This allows for a user to either front-run and deposit (in case the auction will be settling at a higher price) or prepare for a withdrawal and then withdraw their share at a higher price before the auction settles at a lower price inflicting the loss to the other shareholders. This also affects the new depositors since the _minSharesAmountOut won't be effective

  2. Interest repayment: In case of a large interest repayment, users who monitor for this can front run this repayment and then queue a withdrawal. This way they won't be deposited into the pool but will still earn the interest

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

  1. User monitors a large repayment of interest
  2. User front-runs this tx and deposits into the pool
  3. User then queues withdrawal for their shares to take the profit

Impact

Naive users can suffer unfair losses

PoC

No response

Mitigation

Implementing a depsoit queue could solve the share value increase issue