Lines of code

Vulnerability details

Impact

The quoted reserve value is not based on the constant sum approach. It is based on constant product method.

The quoted values are not correct for constant sum based approach.

#Proof of Concept

As per the Joe documentation, it says that joe is based on constant sum approach.

function quote(
    uint256 amountA,
    uint256 reserveA,
    uint256 reserveB
) internal pure returns (uint256 amountB) {
    if (amountA == 0) revert JoeLibrary__InsufficientAmount();
    if (reserveA == 0 || reserveB == 0) revert JoeLibrary__InsufficientLiquidity();
    amountB = (amountA * reserveB) / reserveA;
}

But when we look at the quote method, it is using the constant product approach to find the one of the reserve value.

But the Joe dosumentation says that it is following the constant sum method.

Tools Used

VS code

Recommended Mitigation Steps

Use constant sum based approach to determine the reserve asset value.
Follow the Joe’s formulation as given in document.

---

The text was updated successfully, but these errors were encountered:

👎 1 Shungy reacted with thumbs down emoji

All reactions

• 👎 1 reaction