erc4626-alliance / erc4626-contracts Goto Github PK

https://github.com/fei-protocol/ERC4626/blob/ea34f9a3d9276b5fddc1694446ea1aadacf6b91c/src/xERC4626.sol#L92

👋 Love xERC4626 but I think I've hit a bug and I'm not sure of the best solution.

I wrote a test that shows the error case here: emersoncloud@bb26d16

The bug occurs when one tries to redeem shares for more assets than are in storedTotalAssets. This can happen after rewards have been minted, time advanced somewhere in the rewards cycle and syncRewards has not been called yet.

At that point the rewards show up in totalAssets [1], but haven't yet been moved to storedTotalAssets (which happens in syncRewards) [2].

So when beforeWithdraw is hit from the redeem call, we attempt to subtract the amount of underlying + rewards the caller is owed. But the rewards aren't reflected in storedTotalAssets yet and the subtraction underflows [3].

[1] https://github.com/fei-protocol/ERC4626/blob/643cd044fac34bcbf64e1c3790a5126fec0dbec1/src/xERC4626.sol#L45-L62

[2] https://github.com/fei-protocol/ERC4626/blob/643cd044fac34bcbf64e1c3790a5126fec0dbec1/src/xERC4626.sol#L87

[3] https://github.com/fei-protocol/ERC4626/blob/643cd044fac34bcbf64e1c3790a5126fec0dbec1/src/xERC4626.sol#L65-L68

https://github.com/fei-protocol/ERC4626/blob/7337853ed4411b712d0f8020b0106d47ad94b921/src/test/mocks/MockxERC4626.sol#L22

should probably be warping forward so add block.timestamp +