Damaged Hazelnut Wolverine - Inflated ETH Conversion in Numa to ETH conversion from vault in getNbOfNuAssetFromNuma

[sherlock-admin3]

Damaged Hazelnut Wolverine

Medium

Inflated ETH Conversion in Numa to ETH conversion from vault in getNbOfNuAssetFromNuma

Summary

The getNbOfNuAssetFromNuma function in the NumaPrinter contract incorrectly calculates the ETH equivalent of Numa tokens due to an inflated buy fee applied in the numaToEth function of the VaultManager contract. This results in an inaccurate conversion rate from vault when minting nuAssets.

Root Cause

https://github.com/sherlock-audit/2024-12-numa-audit/blob/ae1d7781efb4cb2c3a40c642887ddadeecabb97d/Numa/contracts/NumaProtocol/NumaPrinter.sol#L354

The numaToEth function in the VaultManager contract applies a buy fee to the ETH amount returned by inflating the value returned with buy fee

       function numaToEth(
        uint _inputAmount,
        PriceType _t
    ) public view returns (uint256) {
        (, , uint criticalScaleForNumaPriceAndSellFee, ) = getSynthScaling();
        uint result = numaToToken(
            _inputAmount,
            1 ether,
            1 ether,
            criticalScaleForNumaPriceAndSellFee
        );
        if (_t == PriceType.BuyPrice) {
  >>          result = (result * 1 ether) / getBuyFee();
        } else if (_t == PriceType.SellPrice) {
            (uint sellfee, , ) = getSellFeeScaling();
            result = (result * sellfee) / 1 ether;
        }
        return result;
    }

This leads to an incorrect ETH equivalent for the Numa tokens passed in the vaultmanager

Internal pre-conditions

numaToEth is called with PriceType.BuyPrice.
Buy fee is applied within numaToEth function in Vaultmanager

External pre-conditions

getNbOfNuAssetFromNuma is called to convert Numa to nuAssets.
VaultManager is integrated with NumaPrinter.

Attack Path

User calls getNbOfNuAssetFromNuma through mintAssetFromNumaInput
numaToEth inflates ETH value due to buy fee.

Impact

The inflated ETH conversion causes the system to default to using the pool price for nuAsset minting, even when the vault price would be more favorable.

PoC

No response

Mitigation

uint256 ethAmountVault = vaultManager.numaToEth(
            _numaAmount - amountToBurn,
 +           IVaultManager.PriceType.SellPrice
        );