FractionERC1155DataManager Manual Review Findings

FEM-01M: Incorrect Data Usage

Type	Severity	Location
Logical Fault		FractionERC1155DataManager.sol:L117, L119

Description:

The FractionERC1155DataManager::partiallyUnlockWrappedAssets function will burn the fractions of the caller prior to measuring the FractionERC1155DataManager::localMintBurnSupply thereby calculating the user's proportion incorrectly as the value of the supply would have had the fractions of the user subtracted.

Impact:

The percentage owed to a user when partially unwrapping through the FractionERC1155DataManager::partiallyUnlockWrappedAssets function is inflated and will tap into other users' funds.

Example:

Copy
115/// @inheritdoc IFraction
116function partiallyUnlockWrappedAssets(uint256 fractionsToBurn, bool skipNonPercentageWtypes, address beneficiary) external onlyPrimaryChain {
117    burn(_msgSender(), 0, fractionsToBurn);
118
119    uint256 percentage = (fractionsToBurn * 1 ether) / localMintBurnSupply(0);
120
121    IWrapper(wrapper).percentageBeneficiaryPartiallyUnwrapAssets(nftId, percentage, skipNonPercentageWtypes, beneficiary);
122
123    emit WrappedAssetsUnlocked(nftId, beneficiary, percentage);
124}

Recommendation:

We advise the system to measure the supply prior to performing the burn operation, ensuring that the user's percentage owed has been correctly calculated.

Alleviation (c6b23c23d8bcd8cce85049ad959cbd711a37126b):

The code was updated to utilize the totalSupplyGenesisIds of the refactored genesis ID based system that represents the total supply prior to the burn operation, ensuring that the percentage proportion calculated is correct.