processDeposit()
can cause a DoS if equityAfter is 0 and equityBefore > 0.Low Risk
https://github.com/Cyfrin/2023-10-SteadeFi/blob/0f909e2f0917cb9ad02986f631d622376510abec/contracts/strategy/gmx/GMXProcessDeposit.sol#L28
When minting the user's gvToken
in ProcessDeposit.sol
, if equityAfter is 0 and equityBefore is a positive number, an evmRevert will occur due to arithmetic underflow.
The calculation for minting the user's gvToken (share token) after the user deposits into the vault is based on the equity value of the vault.
function processDeposit(
GMXTypes.Store storage self
) external {
self.depositCache.healthParams.equityAfter = GMXReader.equityValue(self);
self.depositCache.sharesToUser = GMXReader.valueToShares(
self,
//@audit if equityAfter is 0 this can cause evmRevert with arithmetic underflow
self.depositCache.healthParams.equityAfter - self.depositCache.healthParams.equityBefore,
self.depositCache.healthParams.equityBefore
);
GMXChecks.afterDepositChecks(self);
}
If we examine the equity value calculation, it is simply the difference between the GM token value and the total debt value. If the equity value is less than the debt, the function returns 0 to avoid underflow within the function.
function equityValue(GMXTypes.Store storage self) public view returns (uint256) {
(uint256 _tokenADebtAmt, uint256 _tokenBDebtAmt) = debtAmt(self);
uint256 assetValue_ = assetValue(self); //total value of GM held by vault
uint256 _debtValue = convertToUsdValue(self, address(self.tokenA), _tokenADebtAmt)
+ convertToUsdValue(self, address(self.tokenB), _tokenBDebtAmt); //debt taken from lending vault
// in underflow condition return 0
unchecked {
if (assetValue_ < _debtValue) return 0; //@audit returns 0 if debt > equity
return assetValue_ - _debtValue;
}
}
After a deposit, if _debtValue
is less than assetValue
, then equityValue
will return 0. This value is used in the processDeposit
function, so 0 - equityBefore
will always result in an underflow, causing a DoS of the system.
The severity of this issue depends on the GM token value and the debt value of the vault. If the debt is greater, for example, for 10 days, the vault will be unusable for 10 days.
DoS of the system until assetValue > _debtValue.
manual review
Do not allow the deposit if debt > equity until the rebalance has occurred.