You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The PsmLib.lvRedeemRaWithCtDs() function doesn't decrease the locked amount of RA
Summary
The lvRedeemRaWithCtDs() function is invoked when exchanging CT + DS for RA (through redeemEarly -> _liquidateLpPartial -> _redeemCtDsAndSellExcessCt). This function only burns CT + DS without decreasing the locked amount of RA.
Vulnerability Detail
As you can see, the lvRedeemRaWithCtDs() function only burns CT + DS without decreasing the locked amount of RA. Consequently, psm.balances.ra.locked (which represents the amount of locked RA) will be greater than it should be, leading to a loss of funds for the protocol, as the locked RA will be distributed to users after expiry.
sherlock-admin3
changed the title
Acrobatic Cider Cougar - The PsmLib.lvRedeemRaWithCtDs() function doesn't decrease the locked amount of RA
KupiaSec - The PsmLib.lvRedeemRaWithCtDs() function doesn't decrease the locked amount of RASep 25, 2024
KupiaSec
High
The
PsmLib.lvRedeemRaWithCtDs()
function doesn't decrease the locked amount ofRA
Summary
The
lvRedeemRaWithCtDs()
function is invoked when exchangingCT + DS
forRA
(through redeemEarly -> _liquidateLpPartial -> _redeemCtDsAndSellExcessCt). This function only burnsCT + DS
without decreasing the locked amount ofRA
.Vulnerability Detail
As you can see, the
lvRedeemRaWithCtDs()
function only burnsCT + DS
without decreasing the locked amount ofRA
. Consequently,psm.balances.ra.locked
(which represents the amount of lockedRA
) will be greater than it should be, leading to a loss of funds for the protocol, as the lockedRA
will be distributed to users after expiry.Impact
Loss of
RA
for the protocol.Code Snippet
https://github.com/sherlock-audit/2024-08-cork-protocol/tree/main/Depeg-swap/contracts/libraries/PsmLib.sol#L125-L128
Tool used
Manual Review
Recommendation
Also, decrease the locked amount of
RA
.Duplicate of #166
The text was updated successfully, but these errors were encountered: