## Summary Sensitive functions in the Self Pegging Asset Contract that require computation of D token balance using _getD(...) function would always revert when any of the Contract Token is of zero Value or if any incoming token is empty due to Swaps, Redeem Withdrawals and Market Crash. This is because of Division by zero Error during D computation. This create a problem whereby the state of one token is affection the functionalities of other tokens ## Finding Description ```solidity /** * @dev Computes D given token balances. * @param _balances Normalized balance of each token. * @return D The SelfPeggingAsset invariant. */ function _getD(uint256[] memory _balances, uint256 _A) internal pure returns (uint256) { uint256 sum = 0; uint256 Ann = _A; uint256 length = _balances.length; bool allZero = true; for (uint256 i = 0; i < length; i++) { uint256 bal = _balances[i]; if (bal != 0) allZero = false; >> else bal = 1; sum += bal; Ann *= length; } if (allZero) return 0; uint256 D = sum; for (uint256 i = 0; i < 255; i++) { uint256 pD = D; for (uint256 j = 0; j < length; j++) { >> pD = (pD * D) / (_balances[j] * length); ❌ } uint256 prevD = D; D = ((Ann * sum + pD * length) * D) / ((Ann - 1) * D + (length + 1) * pD); if (D > prevD && D - prevD <= 1 || D <= prevD && prevD - D <= 1) break; } return D; } ``` The function above is a sensitive functions that is used to estimate balance value based on contract interactions from minting to redeem, donating, Loss distribution, Rebase and syncing TotalSupply. The problem is that depending how D computation is done in the contract it would always revert when any empty balance value is passed in as parameter during the cause of the call thereby causing DOS as would be noted in the POC provided by this report. This is because pD = (pD * D) / (_balances[j] * length); would result to devision by zero and always revert affecting other tokens ## Impact Explanation - Major Functionalities like donateD, minting, Redeem, Loss distribution, Rebase and syncing TotalSupply would always revert when any of the token in the contract is at zero value. - These functions would also always revert in situations when users only want to interact using specific tokens meaning by design users would have to leave the amounts parameter for those tokens empty which will always revert during D computation, as proven in the provided POC in this report which show how user was unable to donate specific token to the contract ## Likelihood Explanation High Likelihood as this always revert without any sophisticated conditions ## Proof of Concept ```solidity function test_DivisionByZeroRevert() public { uint256 numerator = 100; uint256 denominator = 0; uint256 result; result = numerator / denominator; } function test_ContractCompleteDos() external { MockExchangeRateProvider rETHExchangeRateProvider = new MockExchangeRateProvider(1e18, 18); MockExchangeRateProvider wstETHExchangeRateProvider = new MockExchangeRateProvider(1e18, 18); MockExchangeRateProvider testTokenExchangeRateProvider = new MockExchangeRateProvider(1e18, 18); MockToken rETH = new MockToken("rETH", "rETH", 18); MockToken wstETH = new MockToken("wstETH", "wstETH", 18); MockToken testToken = new MockToken("testToken", "testToken", 6); address[] memory _tokens = new address[](3); _tokens[0] = address(rETH); _tokens[1] = address(wstETH); _tokens[2] = address(testToken); IExchangeRateProvider[] memory exchangeRateProviders = new IExchangeRateProvider[](3); exchangeRateProviders[0] = IExchangeRateProvider(rETHExchangeRateProvider); exchangeRateProviders[1] = IExchangeRateProvider(wstETHExchangeRateProvider); exchangeRateProviders[2] = IExchangeRateProvider(testTokenExchangeRateProvider); ERC1967Proxy proxy = new ERC1967Proxy(address(new SPAToken()), new bytes(0)); SPAToken _spaToken = SPAToken(address(proxy)); uint256[] memory _fees = new uint256[](3); _fees[0] = 0; _fees[1] = 0; _fees[2] = 0; uint256[] memory _precisions = new uint256[](3); _precisions[0] = 1; _precisions[1] = 1; _precisions[2] = 1e12; bytes memory data = abi.encodeCall( SelfPeggingAsset.initialize, (_tokens, _precisions, _fees, 0, _spaToken, A, exchangeRateProviders, address(0), 0, owner) ); proxy = new ERC1967Proxy(address(new SelfPeggingAsset()), data); SelfPeggingAsset _pool = SelfPeggingAsset(address(proxy)); _spaToken.initialize("SPA Token", "TSPA", 5e8, owner, address(_pool)); uint256[] memory amounts = new uint256[](3); amounts[0] = 100e18; amounts[1] = 100e18; amounts[2] = 1000_000; // Mint Liquidity rETH.mint(user, 100e18); wstETH.mint(user, 100e18); testToken.mint(user, 1000_000); vm.startPrank(user); rETH.approve(address(_pool), 100e18); wstETH.approve(address(_pool), 100e18); testToken.approve(address(_pool), 1e6); // initial minting to set up all tokens _pool.mint(amounts, 0); vm.stopPrank(); uint256[] memory donationAmounts = new uint256[](3); donationAmounts[0] = 10e18; //caller only wants to mint first token donationAmounts[1] = 0; donationAmounts[2] = 0; rETH.mint(user2, 10e18); vm.startPrank(user2); rETH.approve(address(pool), 10e18); vm.expectRevert(); //[FAIL: panic: division or modulo by zero (0x12)] pool.donateD(donationAmounts, 0); vm.expectRevert();//[FAIL: panic: division or modulo by zero (0x12)] pool.mint(donationAmounts, 0); vm.stopPrank(); } ``` the first function test_DivisionByZeroRevert can be tested as it would revert due to zero division show how token with zero balance value would revert D computation in the self pegging contract The test code above should be copied and pasted in SelfPeggingAsset.t.sol test contract and the command `forge test --match-test test_ContractCompleteDos -vv` should be ran in terminal, it shows how donating and minting fails when only specific tokens are intended to be interacted with. Ran 1 test for test/SelfPeggingAsset.t.sol:SelfPeggingAssetTest [PASS] test_ContractCompleteDos() (gas: 9090734) Suite result: ok. 1 passed; 0 failed; 0 skipped; finished in 7.77ms (2.42ms CPU time) ## Recommendation I believe this issue can be fixed by approaching the second balance loop in the _getD(...) function just like the first loop which ensures any token balance that is at zero value is given a dust value of 1 Wei for the purpose of calculation as adjusted below ```solidity function _getD(uint256[] memory _balances, uint256 _A) internal pure returns (uint256) { uint256 sum = 0; uint256 Ann = _A; uint256 length = _balances.length; bool allZero = true; for (uint256 i = 0; i < length; i++) { uint256 bal = _balances[i]; if (bal != 0) allZero = false; else bal = 1; sum += bal; Ann *= length; } if (allZero) return 0; uint256 D = sum; for (uint256 i = 0; i < 255; i++) { uint256 pD = D; for (uint256 j = 0; j < length; j++) { +++ uint256 bal = _balances[j]; +++ if (bal == 0) bal = 1; --- pD = (pD * D) / (_balances[j] * length); +++ pD = (pD * D) / ( bal * length); } uint256 prevD = D; D = ((Ann * sum + pD * length) * D) / ((Ann - 1) * D + (length + 1) * pD); if (D > prevD && D - prevD <= 1 || D <= prevD && prevD - D <= 1) break; } return D; } ``` If this change the calculation to inflate dust value to users, protocol can balance the calculation where necessary

GambitMove

Public reviews