highLogic errorEVM-Solidity
Saffron Lido Vaults: `totalEarnings` is incorrect when withdrawing after ending which will withdraw too many funds leaving the `Vault` insolvent
- Payout
- $0
- Protocol
- Saffron Lido Vaults
- Disclosed
- Sep 21, 2024
- Source
- sherlock
In Saffron's Lido vault, `vaultEndedWithdraw()` computes `totalEarnings` by scaling the withdrawn staking shares to the current ETH value but subtracts `totalProtocolFee` as a flat amount that was accreted at an older, lower stETH price. Because the fee is not …
Similar reports
- No close matches yet.
References
This report is already public and closed. Coin Buggie never publishes active or unpatched vulnerability data.