Loss of funds when redeem in RageDnDepository

Summary

When asset decimals are less than redeemable decimals is possible to loss of user's funds due to round down issue

Vulnerability Detail

In case of asset is USDC (6 decimals) and redeemable is UXD (18 decimals) if a user tries to redeem less than the difference of decimals (18-6 = 12 decimals) they will lose all UXD tokens.

Impact

The lack of validation makes users lose redeemable tokens and not receive USDC in charge.

POC

it("can redeem zero tokens", async () => {
  //Modified deployRageDnDepositoryFixture to use assetToken as USDC (6 decimals)
  const {depository, controller, assetToken} = await loadFixture(deployRageDnDepositoryFixture);

  const assetAmount = ethers.utils.parseUnits("1", 6);
  const assetAmountRedeem = ethers.utils.parseUnits("1", 11);

  await (await assetToken.transfer(depository.address, assetAmount)).wait();
  await (await controller.deposit(assetToken.address, assetAmount)).wait();

  const assetBefore = await depository.netAssetDeposits();
  const redeemableBefore = await depository.redeemableUnderManagement();
  await (await controller.withdraw(assetToken.address, assetAmountRedeem, bob.address)).wait();
  const assetAfter = await depository.netAssetDeposits();
  const redeemableAfter = await depository.redeemableUnderManagement();

  //Not change the netAssetDeposits because the value is 0
  expect(assetBefore).to.equal(assetAfter);
  //But changed the redeemable under management value meaning that the user burned redeemable tokens
  expect(redeemableBefore).to.equal(redeemableAfter.add(assetAmountRedeem));
});

Code Snippet

RageDnDepository.sol#L120-L138

function redeem(address asset, uint256 redeemableAmount)
  external
  onlyController
  returns (uint256)
{
  if (asset != assetToken) {
	  revert UnsupportedAsset(asset);
  }

	//@audit USDC asset, UXD redeemable and redeemableAmount = 1e11
	//@audit assetAmount = redeemableAmount * (USDC decimals) / (UXD decimals)
	//@audit assetAmount = 1e11 * 1e6 / 1e18 = 0 
  uint256 assetAmount = _redeemableToAssets(redeemableAmount);
  redeemableUnderManagement -= redeemableAmount;
  netAssetDeposits -= assetAmount;

  uint256 shares = vault.withdraw(
    assetAmount,
    address(controller),
    address(this)
  );
  emit Withdrawn(msg.sender, assetAmount, redeemableAmount, shares);

  return assetAmount;
}

In this case the assetAmount = 0 but redeemableAmount != 0, burning UXD amount but not returning any USDC to the user.

Tool used

Manual Review

Recommendation

It is recommended to add validation to check if assetAmount ≠ 0

uint256 assetAmount = _redeemableToAssets(redeemableAmount);
+if(assetAmount == 0) revert InvalidRedeemalbeAmount();
redeemableUnderManagement -= redeemableAmount;
netAssetDeposits -= assetAmount;

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

064.md

064.md

Loss of funds when redeem in RageDnDepository

Files

064.md

Latest commit

History

064.md

File metadata and controls

Loss of funds when redeem in RageDnDepository