Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

M-02 MitigationConfirmed #30

Open
c4-submissions opened this issue Sep 28, 2023 · 2 comments
Open

M-02 MitigationConfirmed #30

c4-submissions opened this issue Sep 28, 2023 · 2 comments
Labels
confirmed for report This issue is confirmed for report mitigation-confirmed MR-M-02 satisfactory satisfies C4 submission criteria; eligible for awards

Comments

@c4-submissions
Copy link
Contributor

Lines of code

Vulnerability details

Lines of code

https://github.com/reserve-protocol/protocol/blob/9ee60f142f9f5c1fe8bc50eef915cf33124a534f/contracts/plugins/assets/compoundv3/CTokenV3Collateral.sol#L56
https://github.com/reserve-protocol/protocol/blob/9ee60f142f9f5c1fe8bc50eef915cf33124a534f/contracts/plugins/assets/compoundv3/CusdcV3Wrapper.sol#L46
https://github.com/reserve-protocol/protocol/blob/9ee60f142f9f5c1fe8bc50eef915cf33124a534f/contracts/plugins/assets/compoundv3/CusdcV3Wrapper.sol#L236

Vulnerability details

A discrepancy was found within the CTokenV3Collateral contract concerning _underlyingRefPerTok(). The original implementation utilized the erc20Decimals from the CusdcV3Wrapper contract (instead of comet.decimals()) which resulted in inaccurate conversions due to decimal misalignment with the underlying Comet token.

Mitigation

PR #889
The sponsor took the mitigation steps to resolve the issue by replacing erc20Decimals with comet.decimals() ensuring the correct decimal precision is utilized in _underlyingRefPerTok() with an added measure to cache comet.decimals() for gas optimization.

Conclusion

The mitigation has been successfully implemented and reviewed, addressing the initial vulnerability concerning the incorrect decimal precision in _underlyingRefPerTok() of the CTokenV3Collateral contract. This modification ensures that the conversion ratio between collateral and reference units is accurately computed moving forward.
c4-submissions added a commit that referenced this issue Sep 28, 2023
@c4-submissions
RaymondFam issue #30
e32b41b
@c4-judge
Copy link

c4-judge commented Oct 9, 2023

thereksfour marked the issue as satisfactory

@c4-judge c4-judge added the satisfactory satisfies C4 submission criteria; eligible for awards label Oct 9, 2023
@c4-judge
Copy link

c4-judge commented Oct 9, 2023

thereksfour marked the issue as confirmed for report

@c4-judge c4-judge added the confirmed for report This issue is confirmed for report label Oct 9, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
confirmed for report This issue is confirmed for report mitigation-confirmed MR-M-02 satisfactory satisfies C4 submission criteria; eligible for awards
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
2 participants
@c4-judge @c4-submissions