L-14. `processDeposit()` can cause a DoS if equityAfter is 0 and equityBefore

Submitted by 0xanmol.

Relevant GitHub Links

https://github.com/Cyfrin/2023-10-SteadeFi/blob/0f909e2f0917cb9ad02986f631d622376510abec/contracts/strategy/gmx/GMXProcessDeposit.sol#L28

Summary

When minting the user's gvToken in ProcessDeposit.sol, if equityAfter is 0 and equityBefore is a positive number, an evmRevert will occur due to arithmetic underflow.

Vulnerability Details

The calculation for minting the user's gvToken (share token) after the user deposits into the vault is based on the equity value of the vault.

javascript
function processDeposit(
GMXTypes.Store storage self
) external {
self.depositCache.healthParams.equityAfter = GMXReader.equityValue(self);

self.depositCache.sharesToUser = GMXReader.valueToShares(
self,
//@audit if equityAfter is 0 this can cause evmRevert with arithmetic underflow
self.depositCache.healthParams.equityAfter - self.depositCache.healthParams.equityBefore,
self.depositCache.healthParams.equityBefore
);

GMXChecks.afterDepositChecks(self);
}

If we examine the equity value calculation, it is simply the difference between the GM token value and the total debt value. If the equity value is less than the debt, the function returns 0 to avoid underflow within the function.

javascript
function equityValue(GMXTypes.Store storage self) public view returns (uint256) {
(uint256 _tokenADebtAmt, uint256 _tokenBDebtAmt) = debtAmt(self);

uint256 assetValue_ = assetValue(self); //total value of GM held by vault

uint256 _debtValue = convertToUsdValue(self, address(self.tokenA), _tokenADebtAmt)
+ convertToUsdValue(self, address(self.tokenB), _tokenBDebtAmt); //debt taken from lending vault

// in underflow condition return 0
unchecked {
if (assetValue_ < _debtValue) return 0; //@audit returns 0 if debt > equity

return assetValue_ - _debtValue;
}
}

After a deposit, if _debtValue is less than assetValue, then equityValue will return 0. This value is used in the processDeposit function, so 0 - equityBefore will always result in an underflow, causing a DoS of the system.

The severity of this issue depends on the GM token value and the debt value of the vault. If the debt is greater, for example, for 10 days, the vault will be unusable for 10 days.

Impact

DoS of the system until assetValue > _debtValue.

Tools Used

manual review

Recommendations

Do not allow the deposit if debt > equity until the rebalance has occurred.