Merge pull request #240 from Ithil-protocol/audit-fix-h1

audit fix h1
Ithil-protocol · Jan 10, 2024 · dc6c47b · dc6c47b
2 parents d01d51f + d995e87
commit dc6c47b
Show file tree

Hide file tree

Showing 5 changed files with 22 additions and 9 deletions.
diff --git a/src/Vault.sol b/src/Vault.sol
@@ -111,6 +111,19 @@ contract Vault is IVault, ERC4626, ERC20Permit {
         return super.totalAssets() - _calculateLockedProfits();
     }
 
+    function previewWithdraw(uint256 assets) public view override(ERC4626, IERC4626) returns (uint256) {
+        uint256 freeLiq = freeLiquidity();
+        uint256 supply = totalSupply();
+        return assets.mulDiv(supply, freeLiq + netLoans + _calculateLockedLosses());
+    }
+
+    function previewRedeem(uint256 shares) public view override(ERC4626, IERC4626) returns (uint256) {
+        uint256 freeLiq = freeLiquidity();
+        uint256 totalAssetsCache = freeLiq + netLoans + _calculateLockedLosses();
+        uint256 supply = totalSupply();
+        return shares.mulDiv(totalAssetsCache, supply);
+    }
+
     // Assets include netLoans but they are not available for withdraw
     // Therefore we need to cap with the current free liquidity
     function maxWithdraw(address owner) public view override(ERC4626, IERC4626) returns (uint256) {
@@ -228,9 +241,7 @@ contract Vault is IVault, ERC4626, ERC20Permit {
         if (loan > assets) revert LoanHigherThanAssetsInBorrow();
         uint256 freeLiq = freeLiquidity();
 
-        // We do not allow loans higher than the free liquidity
-        // This prevents the vault to go into unhealthy state
-        if (assets >= freeLiq) revert InsufficientFreeLiquidity();
+        if (assets > freeLiq) revert InsufficientFreeLiquidity();
 
         netLoans += loan;
         currentProfits = _calculateLockedProfits();

diff --git a/src/services/credit/CallOption.sol b/src/services/credit/CallOption.sol
@@ -210,7 +210,7 @@ contract CallOption is CreditService {
             // To do this, we take liquidity from the vault and register the loss
             // If we incur a loss and the freeLiquidity is not enough, we cannot make the exit fail
             // Otherwise we would have positions impossible to close: thus we withdraw what we can
-            freeLiquidity = vault.freeLiquidity() - 1;
+            freeLiquidity = vault.freeLiquidity();
             toBorrow = toTransfer - redeemed > freeLiquidity ? freeLiquidity : toTransfer - redeemed;
         }
         // We will always have ithil.balanceOf(address(this)) >= toCall, so the following succeeds

diff --git a/src/services/credit/FixedYieldService.sol b/src/services/credit/FixedYieldService.sol
@@ -64,7 +64,7 @@ contract FixedYieldService is CreditService {
         if (toTransfer > redeemed) {
             // Since this service is senior, we need to pay the user even if redeemable is too low
             // To do this, we take liquidity from the vault and register the loss (no loan)
-            uint256 freeLiquidity = vault.freeLiquidity() - 1;
+            uint256 freeLiquidity = vault.freeLiquidity();
             if (freeLiquidity > 0) {
                 manager.borrow(
                     agreement.loans[0].token,

diff --git a/test/Vault.test.sol b/test/Vault.test.sol
@@ -617,7 +617,9 @@ contract VaultTest is Test {
         vm.stopPrank();
 
         uint256 vaultBalance = token.balanceOf(address(vault));
-        vm.expectRevert(IVault.InsufficientFreeLiquidity.selector);
-        vault.borrow(vaultBalance, vaultBalance, address(this));
+        if (vaultBalance < type(uint256).max) {
+            vm.expectRevert(IVault.InsufficientFreeLiquidity.selector);
+            vault.borrow(vaultBalance + 1, vaultBalance + 1, address(this));
+        }
     }
 }
diff --git a/test/services/SeniorCallOption.test.sol b/test/services/SeniorCallOption.test.sol
@@ -106,7 +106,7 @@ contract CallOptionTest is BaseIntegrationServiceTest {
         vm.stopPrank();
         uint256 assets = IVault(manager.vaults(loanTokens[0])).convertToAssets(collaterals[0].amount);
         vm.warp(block.timestamp + 8 * 30 * 86500);
-        if (assets >= IVault(manager.vaults(loanTokens[0])).freeLiquidity()) {
+        if (assets > IVault(manager.vaults(loanTokens[0])).freeLiquidity()) {
             vm.expectRevert(bytes4(keccak256(abi.encodePacked("InsufficientLiquidity()"))));
             service.close(0, abi.encode(1e17, 0));
         } else {
@@ -123,7 +123,7 @@ contract CallOptionTest is BaseIntegrationServiceTest {
         vm.stopPrank();
         uint256 assets = IVault(manager.vaults(loanTokens[0])).convertToAssets(collaterals[0].amount);
         vm.warp(block.timestamp + 8 * 30 * 86500);
-        if (assets >= IVault(manager.vaults(loanTokens[0])).freeLiquidity()) {
+        if (assets > IVault(manager.vaults(loanTokens[0])).freeLiquidity()) {
             vm.expectRevert(bytes4(keccak256(abi.encodePacked("InsufficientLiquidity()"))));
             service.close(0, abi.encode(1e17, 0));
         } else {