Submitted by hyh
The condition isnt checked now as the whole balance is used instead of the Yeti tokens bought back from the market.
As its not checked, the amount added to effectiveYetiTokenBalance during rebase can exceed the actual amount of the Yeti tokens owned by the contract.
As the before check amount is calculated as the contract net worth, it can be fixed by immediate buy back, but it will not be the case.
The deficit of Yeti tokens can materialize in net worth terms as well if Yeti tokens price will raise compared to the last used one.
In this case users will be cumulatively accounted with the amount of tokens that cannot be actually withdrawn from the contract, as its net holdings will be less then total users claims.
In other words, the contract will be in default if enough users claim after that.
Now the whole balance amount is used instead of the amount bought back from market.
Rebasing amount is added to effectiveYetiTokenBalance, so it should be limited by extra Yeti tokens, not the whole balance:
https://github.com/code-423n4/2021-12-yetifinance/blob/main/packages/contracts/contracts/YETI/sYETIToken.sol#L247
It looks like only extra tokens should be used for the check, i.e. yetiToken.balance - effectiveYetiTokenBalance.
Now:
As the _getValueOfContract function isnt used elsewhere, the logic can be simplified.
To be:
kingyetifinance (Yeti finance) disagreed with severity and confirmed:
0xtruco (Yeti finance) commented:
