Obsidian - The totalAssets() function is not ERC 4626 compliant
#560
Labels
Duplicate
A valid issue that is a duplicate of an issue with `Has Duplicates` label
Medium
A Medium severity issue.
Reward
A payout will be made for this issue
Sponsor Disputed
The sponsor disputed this issue's validity
Won't Fix
The sponsor confirmed this issue will not be fixed
Comments
sherlock-admin3
added
Sponsor Disputed
z3s
added
the
Duplicate
sherlock-admin4
changed the title
totalAssets() function is not ERC 4626 complianttotalAssets() function is not ERC 4626 compliant
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Obsidian
Medium
The
totalAssets()function is not ERC 4626 compliantSummary
ERC-4626 clearly states the following about the
totalAssets()function:The issue is that the protocol's implementation of the function does not account for the fact that some of the assets are the accumulated interest fee.
The protocol accumulates the interest fee by minting shares to the
feeRecipient()every time theaccruefunction is called.The
totalAssets()function should subtract the accumulated interest fee from the currently calculated amount of total assets to return a value that is including the fees charged on interest.Root Cause
totalAssets()does not subtract the accumulated interest feesInternal pre-conditions
No response
External pre-conditions
No response
Attack Path
No response
Impact
SuperPool is not ERC-4626 compliant, this can pose issues with external integrations that expect strict compliance
PoC
No response
Mitigation
Implement a variable to track the fee amount, subtract it from
totalAssets()This may require redesigning functions that implement
totalAssets()Duplicate of #110
The text was updated successfully, but these errors were encountered: