Submitted by cccz, also found by cducrest, ElKu and bytes032.
buyAllAmount will return the amount of tokens spent on the exchange, but the actual return value is less than the actual amount of tokens spent.
Consider WBTC price is 10000 USDC and the total fee is 10%.
The user calls buyAllAmount to buy 1 WBTC, and the calculated fill_amt is 10,000 USDC.
In the buy function, the 1 WBTC to be purchased minus the fee is 0.9 WBTC. That is, the user actually spends 10,000 USDC to buy 0.9 WBTC, and the fill_amt finally returned is 10000 USDC minus the fee is 9000 USDC, but the user actually spends 10000 USDC, which causes the return value of buyAllAmount to be incorrect.
https://github.com/code-423n4/2023-04-rubicon/blob/511636d889742296a54392875a35e4c0c4727bb7/contracts/RubiconMarket.sol#L1064-L1107
Change to:
HickupHH3 (judge) commented:
