Skip to content

maxRedeem Rounding

Low
Schlagonia published GHSA-5gch-72gm-4xjv Oct 21, 2024

Package

No package listed

Affected versions

v3.0.0 - v3.0.1

Patched versions

v3.0.2

Description

Affected versions

  • v3.0.0
  • v3.0.1

Summary

During maxRedeem, internally, the amount is rounded up and in some cases can lead to 1 wei more shares than actually possible to redeem when the amount to redeem is limited by the strategy's withdraw limit.

    function maxRedeem(address owner) public view returns (uint256 _maxRedeem) {
        _maxRedeem = IBaseStrategy(address(this)).availableWithdrawLimit(owner);
        ....
         _maxRedeem = Math.min(
             // Use preview withdraw to round up
             previewWithdraw(_maxRedeem),
             balanceOf(owner)
         );
     }

Impact

If required conditions are met, an attempt by a user to exit their position using the output of maxRedeem will revert.

Patches

Patch introduced in v3.0.2

Workarounds

If the strategy is not liquid enough to support a user redemption, subtract 1 wei from the the maxRedeem amount and use it in the redeem function instead.

Severity

Low

CVE ID

No known CVE

Weaknesses

No CWEs