Submitted by IllIllI
https://docs.aave.com/developers/tokens/atoken
Incorrect share conversions lead to incorrect pricing of assets and loss of principal. aTokens are rebasing tokens, which means that holders of the token have their balanceof() increase over time, but each token is still redeemable for exactly one underlying asset. Any formula that does not return one out for one in is incorrect.
AaveV3YieldSource.sol#L352-L374
The above code is used for both supplyTokenTo() and redeemToken() and does not return one for one. Consider the following chain of events:
There does not need to be a conversion function - one share must always equal one token.
PierrickGT (PoolTogether) acknowledged and commented:
Justin Goro (judge) decreased severity to Medium and commented:
For this contest, 15 reports were submitted by wardens detailing low risk and non-critical issues. The report highlighted below by MaratCerby received the top score from the judge.
The following wardens also submitted reports: GimelSec, hake, 0xf15ers, gzeon, kebabsec, z3s, Dravee, pauliax, 0x52, 0xDjango, IllIllI, delfin454000, reassor, and Picodes.
