Submitted by WatchPug, also found by cmichel and hyh
TurboSafe.sol#L225-L236
In the current implementation, when calling less() to withdraw Fei from the Vault and use it to repay debt, if the amount of Fei is bigger than the debt balance, the onSafeLess hook will use feiDebt as The amount of Fei withdrawn from the Vault.
As a result, getTotalBoostedForVault[vault] in TurboMaster will be larger than the actual total amount of Fei being used to boost the Vault.
Since the Turbo Gibber may impound some of the Safes collateral and mint a certain amount of Fei and repay the Safes Fei debt with the newly minted Fei. In that case, the Safes debt balance can be less than the amount of Fei in Vault. Which constitutes the precondition for the less() call to case the distortion of getTotalBoostedForVault[vault].
Given:
On master:
On safe:
On master:
On Safe:
Change to:
transmissions11 (Tribe Turbo) commented:
Alex the Entreprenerd (judge) commented:
