Submitted by zhaojie, also found by 0xStalin and rvierdiiev
When totalSupply = 0, the attacker donates 1wei token, causing the number of shares to remain 0 at deposit time.
The toBase function only determines whether total.elastic(_totalAssets) is 0, not whether totalSupply is 0.
When totalSupply=0, if _totalAssets > 0, toBase always returns 0.
An attacker can make a donation of _totalAssets > 0, the toBase function will then compute base through a branch in the else statement, since totalSupply=0.
base = 0 * elastic / total.elastic = 0,
As a result, the number of deposit shares is always 0, and the protocol will not work.
An attacker can send Collateral token to the StrategyAAVEv3(address(this)) contract,
_totalAssets = collateralBalance - debtBalance
VSCode, Manual
hvasconcelos (BakerFi) confirmed
0xleastwood (judge) decreased severity to Medium and commented:
ickas (BakerFi) commented:
