Skip to content

Latest commit

 

History

History
65 lines (39 loc) · 2.14 KB

063.md

File metadata and controls

65 lines (39 loc) · 2.14 KB

Clever Burgundy Poodle

Medium

Inconsistent negative modulo handling causes incorrect tick calculations for secondary positions

Summary

The inconsistent handling of negative modulo values in the Strategy contract causes incorrect tick calculations for secondary positions

Root Cause

In Strategy.sol, there is inconsistent handling of negative modulo values when calculating ticks. While the _setMainTicks function properly handles negative modulo values, the secondary position tick calculation does not include this check:

https://github.com/sherlock-audit/2025-02-yieldoor/blob/main/yieldoor/src/Strategy.sol#L232-L235

https://github.com/sherlock-audit/2025-02-yieldoor/blob/main/yieldoor/src/Strategy.sol#L366-L367

Which later leads to incorrect tick calculations for the secondary position: https://github.com/sherlock-audit/2025-02-yieldoor/blob/main/yieldoor/src/Strategy.sol#L373-L379

Internal Pre-conditions

N/A

External Pre-conditions

  1. The current price tick in the pool needs to be negative

Attack Path

  1. Rebalancer call rebalance() when the tick is at a specific negative value
  2. _setSecondaryPositionsTicks() calculates secondary position ticks without properly handling the negative modulo

Impact

The secondary position will be created with incorrect tick boundaries, which will cause the position to overlap with the price range which is not the intended behavior.

Consider a pool with negative ticks, such as a WETH/USDC pool where WETH is token0:

  • Current tick: -276321 (WETH price is low relative to USDC)
  • Tick spacing: 60
  • Modulo calculation: -276321 % 60 = -21

Without handling negative modulo:

  • Secondary position upper tick would be -276321 - (-21) = -276300
  • This will include the tick price range

With proper handling:

  • Corrected modulo: -21 + 60 = 39
  • Secondary position upper tick would be -276321 - 39 = -276360
  • This will not include the tick price range

PoC

No response

Mitigation

Add the missing negative modulo handling to ensure consistent behavior across all tick calculations:

int24 modulo = tick % tickSpacing;
if (modulo < 0) modulo += tickSpacing;