Fix Review #1

sherlock-admin · 2025-08-15T17:14:48Z

Fix Review of

Repo: cap-labs-dev/cap-contracts
Commit Hash: 403326df39f6987359bba648b7c09f81bd53da62

sherlock-admin · 2025-08-15T22:46:16Z

cap-contracts/contracts/delegation/providers/symbiotic/SymbioticNetworkMiddleware.sol

+        uint256 slashShareOfCollateral =
+            _slashShare == 1e18 ? totalSlashableCollateral : (totalSlashableCollateral * _slashShare / 1e18) + 1;


Change related to cap-labs-dev/cap-contracts#194.

Fixes issues: #154 - Liquidator will attempt to slash more collateral than available due to flawed rounding logic

sherlock-admin · 2025-08-15T22:46:18Z

cap-contracts/contracts/feeAuction/FeeAuction.sol

        balances = new uint256[](assetsLength);
        for (uint256 i; i < assetsLength; ++i) {
            address asset = _assets[i];
+            if (asset == address(0)) revert InvalidAsset();


Change related to cap-labs-dev/cap-contracts#191.

Fixes issues: #112 - Zero Address Validation Missing in _transferOutAssets() Causes Denial of Service

sherlock-admin · 2025-08-15T22:46:21Z

cap-contracts/contracts/interfaces/IFeeAuction.sol

+    /// @dev Asset must be non-zero address
+    error InvalidAsset();
+


Change related to cap-labs-dev/cap-contracts#191.

Fixes issues: #112 - Zero Address Validation Missing in _transferOutAssets() Causes Denial of Service

sherlock-admin · 2025-08-15T22:46:23Z

cap-contracts/contracts/lendingPool/libraries/BorrowLogic.sol

+        if (realizedInterest > 0) {
+            IVault(reserve.vault).borrow(_asset, realizedInterest, $.delegation);
+            IDelegation($.delegation).distributeRewards(_agent, _asset);
+        }
+


Change related to cap-labs-dev/cap-contracts#189.

Fixes issues: #150 - Lender DoS if all asset is borrowed or realized

sherlock-admin · 2025-08-15T22:46:25Z

cap-contracts/contracts/lendingPool/libraries/LiquidationLogic.sol

+    /// @notice No debt to liquidate
+    error NoDebt();
+


Change related to cap-labs-dev/cap-contracts#190.

Fixes issues: #49 - Division by zero in liquidation due to race condition

sherlock-admin · 2025-08-15T22:46:27Z

cap-contracts/contracts/lendingPool/libraries/LiquidationLogic.sol

+        if (totalDebt == 0) revert NoDebt();
+


Change related to cap-labs-dev/cap-contracts#190.

Fixes issues: #49 - Division by zero in liquidation due to race condition

sherlock-admin · 2025-08-15T22:46:29Z

cap-contracts/contracts/lendingPool/libraries/LiquidationLogic.sol

+        (,,,,, health) = ViewLogic.agent($, params.agent);
+        if (health >= 1e27) _closeLiquidation($, params.agent);
+


Change related to cap-labs-dev/cap-contracts#185.

Fixes issues: #145 - Attacker/partial liquidator can extend Liquidation action by resetting $.liquidationStart[_agent] to 0.

sherlock-admin · 2025-08-15T22:46:31Z

cap-contracts/contracts/oracle/libraries/VaultAdapter.sol

            uint256 excess = _utilization - slopes.kink;
            utilizationData.multiplier = utilizationData.multiplier
-                * (1e27 + (1e27 * excess / (1e27 - slopes.kink)) * (_elapsed * $.rate / 1e27)) / 1e27;
+                * (1e27 + (1e27 * excess / (1e27 - slopes.kink)) * _elapsed * $.rate / 1e27) / 1e27;


Change related to cap-labs-dev/cap-contracts#187.

Fixes issues: #148 - Utilization rate multiplier will not shift if oracle is consulted frequently

sherlock-admin · 2025-08-15T22:46:33Z

cap-contracts/contracts/oracle/libraries/VaultAdapter.sol

        } else {
            utilizationData.multiplier = utilizationData.multiplier * 1e27
-                / (1e27 + (1e27 * (slopes.kink - _utilization) / slopes.kink) * (_elapsed * $.rate / 1e27));
+                / (1e27 + (1e27 * (slopes.kink - _utilization) / slopes.kink) * _elapsed * $.rate / 1e27);


Change related to cap-labs-dev/cap-contracts#187.

Fixes issues: #148 - Utilization rate multiplier will not shift if oracle is consulted frequently

sherlock-admin · 2025-08-15T22:46:35Z

cap-contracts/contracts/vault/Vault.sol

+
+        _burn(msg.sender, _amountIn);
+


Change related to cap-labs-dev/cap-contracts#193.

Fixes issues: #439 - Unnecessary gas usage due to function ordering in burn() -- _burn() should be called before VaultLogic.burn()

sherlock-admin · 2025-08-15T22:46:37Z

cap-contracts/contracts/vault/Vault.sol

+        _burn(msg.sender, _amountIn);
+
        divest(_asset, amountOut + fee);
+


Change related to cap-labs-dev/cap-contracts#193.

Fixes issues: #439 - Unnecessary gas usage due to function ordering in burn() -- _burn() should be called before VaultLogic.burn()

sherlock-admin · 2025-08-15T22:46:39Z

cap-contracts/contracts/vault/Vault.sol

+
+        _burn(msg.sender, _amountIn);
+


Change related to cap-labs-dev/cap-contracts#193.

Fixes issues: #439 - Unnecessary gas usage due to function ordering in burn() -- _burn() should be called before VaultLogic.burn()

sherlock-admin · 2025-08-15T22:46:41Z

cap-contracts/contracts/vault/Vault.sol

        }
-
        divestMany(assets(), totalDivestAmounts);
+


Change related to cap-labs-dev/cap-contracts#193.

Fixes issues: #439 - Unnecessary gas usage due to function ordering in burn() -- _burn() should be called before VaultLogic.burn()

sherlock-admin · 2025-08-15T22:46:43Z

cap-contracts/contracts/vault/libraries/FractionalReserveLogic.sol

+        if ($.vault[_asset] != address(0)) {
+            IERC4626($.vault[_asset]).withdraw(claimableInterest($, _asset), $.interestReceiver, address(this));
+            emit FractionalReserveInterestRealized(_asset);
+        }


Change related to cap-labs-dev/cap-contracts#192.

Fixes issues: #143 - Missing Zero Address Check in claimableInterest and realizeInterest

sherlock-admin · 2025-08-15T22:46:45Z

cap-contracts/contracts/vault/libraries/FractionalReserveLogic.sol

+        if ($.vault[_asset] == address(0)) return 0;
+


Change related to cap-labs-dev/cap-contracts#192.

Fixes issues: #143 - Missing Zero Address Check in claimableInterest and realizeInterest

sherlock-admin · 2025-09-02T11:45:46Z

cap-contracts/contracts/delegation/providers/symbiotic/SymbioticNetworkMiddleware.sol

+        uint256 slashShareOfCollateral =
+            _slashShare == 1e18 ? totalSlashableCollateral : (totalSlashableCollateral * _slashShare / 1e18) + 1;


Change related to cap-labs-dev/cap-contracts#194.

Fixes issues: #154 - Liquidator will attempt to slash more collateral than available due to flawed rounding logic

sherlock-admin · 2025-09-02T11:45:48Z

cap-contracts/contracts/feeAuction/FeeAuction.sol

        balances = new uint256[](assetsLength);
        for (uint256 i; i < assetsLength; ++i) {
            address asset = _assets[i];
+            if (asset == address(0)) revert InvalidAsset();


Change related to cap-labs-dev/cap-contracts#191.

Fixes issues: #112 - Zero Address Validation Missing in _transferOutAssets() Causes Denial of Service

sherlock-admin · 2025-09-02T11:45:50Z

cap-contracts/contracts/interfaces/IFeeAuction.sol

+    /// @dev Asset must be non-zero address
+    error InvalidAsset();
+


Change related to cap-labs-dev/cap-contracts#191.

Fixes issues: #112 - Zero Address Validation Missing in _transferOutAssets() Causes Denial of Service

sherlock-admin · 2025-09-02T11:45:53Z

cap-contracts/contracts/lendingPool/libraries/BorrowLogic.sol

+        if (realizedInterest > 0) {
+            IVault(reserve.vault).borrow(_asset, realizedInterest, $.delegation);
+            IDelegation($.delegation).distributeRewards(_agent, _asset);
+        }
+


Change related to cap-labs-dev/cap-contracts#189.

Fixes issues: #150 - Lender DoS if all asset is borrowed or realized, #180 - Cannot repay or liquidate on paused asset

sherlock-admin · 2025-09-02T11:45:55Z

cap-contracts/contracts/lendingPool/libraries/LiquidationLogic.sol

+    /// @notice No debt to liquidate
+    error NoDebt();
+


Change related to cap-labs-dev/cap-contracts#190.

Fixes issues: #49 - Division by zero in liquidation due to race condition

sherlock-admin · 2025-09-02T11:45:57Z

cap-contracts/contracts/lendingPool/libraries/LiquidationLogic.sol

+        if (totalDebt == 0) revert NoDebt();
+


Change related to cap-labs-dev/cap-contracts#190.

Fixes issues: #49 - Division by zero in liquidation due to race condition

sherlock-admin · 2025-09-02T11:45:59Z

cap-contracts/contracts/lendingPool/libraries/LiquidationLogic.sol

+        (,,,,, health) = ViewLogic.agent($, params.agent);
+        if (health >= 1e27) _closeLiquidation($, params.agent);
+


Change related to cap-labs-dev/cap-contracts#185.

Fixes issues: #145 - Attacker/partial liquidator can extend Liquidation action by resetting $.liquidationStart[_agent] to 0.

sherlock-admin · 2025-09-02T11:46:01Z

cap-contracts/contracts/oracle/libraries/VaultAdapter.sol

            uint256 excess = _utilization - slopes.kink;
            utilizationData.multiplier = utilizationData.multiplier
-                * (1e27 + (1e27 * excess / (1e27 - slopes.kink)) * (_elapsed * $.rate / 1e27)) / 1e27;
+                * (1e27 + (1e27 * excess / (1e27 - slopes.kink)) * _elapsed * $.rate / 1e27) / 1e27;


Change related to cap-labs-dev/cap-contracts#187.

Fixes issues: #148 - Utilization rate multiplier will not shift if oracle is consulted frequently

sherlock-admin · 2025-09-02T11:46:03Z

cap-contracts/contracts/oracle/libraries/VaultAdapter.sol

        } else {
            utilizationData.multiplier = utilizationData.multiplier * 1e27
-                / (1e27 + (1e27 * (slopes.kink - _utilization) / slopes.kink) * (_elapsed * $.rate / 1e27));
+                / (1e27 + (1e27 * (slopes.kink - _utilization) / slopes.kink) * _elapsed * $.rate / 1e27);


Change related to cap-labs-dev/cap-contracts#187.

Fixes issues: #148 - Utilization rate multiplier will not shift if oracle is consulted frequently

sherlock-admin · 2025-09-02T11:46:05Z

cap-contracts/contracts/vault/Vault.sol

+
+        _burn(msg.sender, _amountIn);
+


Change related to cap-labs-dev/cap-contracts#193.

Fixes issues: #439 - Unnecessary gas usage due to function ordering in burn() -- _burn() should be called before VaultLogic.burn()

sherlock-admin · 2025-09-02T11:46:07Z

cap-contracts/contracts/vault/Vault.sol

+        _burn(msg.sender, _amountIn);
+
        divest(_asset, amountOut + fee);
+


Change related to cap-labs-dev/cap-contracts#193.

Fixes issues: #439 - Unnecessary gas usage due to function ordering in burn() -- _burn() should be called before VaultLogic.burn()

sherlock-admin · 2025-09-02T11:46:09Z

cap-contracts/contracts/vault/Vault.sol

+
+        _burn(msg.sender, _amountIn);
+


Change related to cap-labs-dev/cap-contracts#193.

Fixes issues: #439 - Unnecessary gas usage due to function ordering in burn() -- _burn() should be called before VaultLogic.burn()

sherlock-admin · 2025-09-02T11:46:11Z

cap-contracts/contracts/vault/Vault.sol

        }
-
        divestMany(assets(), totalDivestAmounts);
+


Change related to cap-labs-dev/cap-contracts#193.

Fixes issues: #439 - Unnecessary gas usage due to function ordering in burn() -- _burn() should be called before VaultLogic.burn()

sherlock-admin · 2025-09-02T11:46:13Z

cap-contracts/contracts/vault/libraries/FractionalReserveLogic.sol

+        if ($.vault[_asset] != address(0)) {
+            IERC4626($.vault[_asset]).withdraw(claimableInterest($, _asset), $.interestReceiver, address(this));
+            emit FractionalReserveInterestRealized(_asset);
+        }


Change related to cap-labs-dev/cap-contracts#192.

Fixes issues: #143 - Missing Zero Address Check in claimableInterest and realizeInterest

sherlock-admin · 2025-09-02T11:46:15Z

cap-contracts/contracts/vault/libraries/FractionalReserveLogic.sol

+        if ($.vault[_asset] == address(0)) return 0;
+


Change related to cap-labs-dev/cap-contracts#192.

Fixes issues: #143 - Missing Zero Address Check in claimableInterest and realizeInterest

sherlock-admin added 2 commits August 15, 2025 17:14

Fix Review Scope

cd28963

Fix Review Scope

b0a1a0f

sherlock-admin commented Aug 15, 2025

View reviewed changes

Fix Review Scope

50ed2a7

sherlock-admin commented Sep 2, 2025

View reviewed changes

		uint256 slashShareOfCollateral =
		_slashShare == 1e18 ? totalSlashableCollateral : (totalSlashableCollateral * _slashShare / 1e18) + 1;

		/// @dev Asset must be non-zero address
		error InvalidAsset();

		(,,,,, health) = ViewLogic.agent($, params.agent);
		if (health >= 1e27) _closeLiquidation($, params.agent);

		_burn(msg.sender, _amountIn);

		divest(_asset, amountOut + fee);

Fix Review #1

Are you sure you want to change the base?

Fix Review #1

Uh oh!

Conversation

sherlock-admin commented Aug 15, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

sherlock-admin commented Aug 15, 2025 •

edited

Loading