Submitted by IllIllI
Rebasing tokens are tokens that have each holders balanceof() increase over time. Aave aTokens are an example of such tokens.
Users expect that when they deposit tokens to a pool, that they get back all rewards earned, not just a flat rate. With the contracts of this project, deposited tokens will grow in value, but the value in excess of the pre-calculated getMaximumRewards()/deposited amounts go solely to the owner/creator, or will remain locked in the contract
In the case of pools, the owner can withdraw the excess rebasing reward tokens by calling withdrawExcessRewards(), but is unable to withdraw excess deposited rebasing tokens. The Merkle-tree-related contracts have no way to withdraw any excess rebasing tokens.
All parts of the code assume that the value stated is the balance that is available to withdraw. It stores the values
(Note: see submission for full Proof of Concept)
Provide a function for the pool owner to withdraw excess deposited tokens and repay any associated taxes. In the case of the Merkle trees though, pro rata share amounts need to be calculated and tracked and updated with every withdrawal, which will require drastic changes to the code, making it much more expensive.
illuzen (FactoryDAO) acknowledged, disagreed with severity and commented:
illuzen (FactoryDAO) resolved:
Justin Goro (judge) commented:
0xleastwood (warden) commented:
IllIllI000 (warden) commented:
ksk2345 (warden) commented:
Justin Goro (judge) commented:
