Status DataClose notification

Kinetic Disclosed Report

Audit Report

Division by Zero in APR Calculation in `Lens.sol`.

Target

https://github.com/kinetic-market/public-money-market-contracts

Vulnerability details

The function _calculatePglAPR in Lens.sol contract doesn't handle the case when pglTotalSupply being zero. As a result, this can cause functions relying on this calculation (like fetching market data) to fail if the PGL token's total supply is zero due to division by zero revert.

In order to remediate this issue, add a check for pglTotalSupply being zero and handle it appropriately (e.g., return zero APR).

Validation steps

In Lens.sol::_calculatePglAPR function:

 function _calculatePglAPR(
        uint protocolTokenRewardSpeed,
        uint protocolTokenReserves,
        uint nativeTokenReserves,
        uint protocolTokenPrice,
        uint nativeTokenPrice,
        uint pglTotalSupply,
        uint totalDepositedPGLTokenAmount
    ) internal pure returns (uint usdPerStakedPglValue) {
        uint protocolTokenReservesValue = (protocolTokenReserves * protocolTokenPrice);
        uint nativeTokenReserveValue = (nativeTokenReserves * nativeTokenPrice);

        uint pglPrice = (protocolTokenReservesValue + nativeTokenReserveValue) / pglTotalSupply;

        usdPerStakedPglValue = _calculateAPR(
            protocolTokenRewardSpeed,
            protocolTokenPrice,
            totalDepositedPGLTokenAmount,
            pglPrice
        );
    }

If pglTotalSupply is zero, the division (protocolTokenReservesValue + nativeTokenReserveValue) / pglTotalSupply will cause a division by zero, leading to a revert.

Comments are hidden

This information is not publicly available.