Kinetic Disclosed Report

Audit report Kinetic Audit Contest

Division by Zero in APR Calculation in `Lens.sol`.

Company
Created date
Feb 11 2025

Target

https://github.com/kinetic-market/public-money-market-contracts

Vulnerability Details

The function _calculatePglAPR in Lens.sol contract doesn't handle the case when pglTotalSupply being zero. As a result, this can cause functions relying on this calculation (like fetching market data) to fail if the PGL token's total supply is zero due to division by zero revert.

In order to remediate this issue, add a check for pglTotalSupply being zero and handle it appropriately (e.g., return zero APR).

Validation steps

In Lens.sol::_calculatePglAPR function:

 function _calculatePglAPR(
        uint protocolTokenRewardSpeed,
        uint protocolTokenReserves,
        uint nativeTokenReserves,
        uint protocolTokenPrice,
        uint nativeTokenPrice,
        uint pglTotalSupply,
        uint totalDepositedPGLTokenAmount
    ) internal pure returns (uint usdPerStakedPglValue) {
        uint protocolTokenReservesValue = (protocolTokenReserves * protocolTokenPrice);
        uint nativeTokenReserveValue = (nativeTokenReserves * nativeTokenPrice);

        uint pglPrice = (protocolTokenReservesValue + nativeTokenReserveValue) / pglTotalSupply;

        usdPerStakedPglValue = _calculateAPR(
            protocolTokenRewardSpeed,
            protocolTokenPrice,
            totalDepositedPGLTokenAmount,
            pglPrice
        );
    }

If pglTotalSupply is zero, the division (protocolTokenReservesValue + nativeTokenReserveValue) / pglTotalSupply will cause a division by zero, leading to a revert.

CommentsReport History
Comments on this report are hidden
Details
Statedisclosed
Severity
Low
Bounty$143
Visibilitypartially
VulnerabilityDoS with (Unexpected) revert
Participants (3)
company admin
author