Return to site
Return to site

Bug Deep Dive #24

ViewFacet.queryAssetBalances doesn't include uncollected uniswap fees for compounded maker position - $886

· Bug Deep Dive
Section image

When ViewFacet.queryAssetBalances calculates the earnings for compounded maker, it ignores the uncollected uniswap fees:

Section image

When the actual compounded maker asset is removed, the uncollected uniswap fees are added to node.fees.xCFees and node.fees.yCFees and compounded as additional liquidity. If liquidity is not increased (fees below compound threshold), then these fees are simply added to xCfees/yCFees. Either way, the value of these uniswap uncollected fees is added to maker earnings, which doesn't happen for ViewFacet.

This results in incorrect earnings reported (less than actual amount) and user can fail to account for these fees, breaking any further logic it has and possibly losing the difference as unrecoverable asset.

The readme puts the issue in scope:

Issues that lead to getting incorrect return values (i.e. deviates from the withdrawal value of the asset by more than 0.01%) from the queryAssetBalance function (even if the appropriate input is used), which will lead to issues when executing other functions, may be considered valid with Medium severity at max.

Alpha: it's extremely common for Uniswap fees to be missed when querying the position value. In this case the readme put view functions in scope, but many times the view function is used internally in state changing functions and still leads to issues.

Conclusion

This finding would earn you $886, always verify that Uniswap fees are correctly tracked, compare the view function with the state changing function, and pay attention to the readme.

Full Report
Codebase

Subscribe
Previous
Bug Deep Dive #23
Next
 Return to site
Cookie Use
We use cookies to improve browsing experience, security, and data collection. By accepting, you agree to the use of cookies for advertising and analytics. You can change your cookie settings at any time. Learn More
Accept all
Settings
Decline All
Cookie Settings
Necessary Cookies
These cookies enable core functionality such as security, network management, and accessibility. These cookies can’t be switched off.
Analytics Cookies
These cookies help us better understand how visitors interact with our website and help us discover errors.
Preferences Cookies
These cookies allow the website to remember choices you've made to provide enhanced functionality and personalization.
Save