Submitted by shw
The calcUnderlyingInStoredUSD() function of SherX should return calcUnderlyingInStoredUSD(getSherXBalance()) instead of calcUnderlyingInStoredUSD(sx20.balances[msg.sender]) since there could be SherX unallocated to the user at the time of the function call. A similar function, calcUnderlying(), calculates the users underlying tokens based on the users current balance plus the unallocated ones.
Recommend changing sx20.balances[msg.sender] to getSherXBalance() at L141 in SherX.sol.
Evert0x (Sherlock) confirmed:
ghoul-sol (judge) disagreed with severity:
