FractionERC20DataManager Manual Review Findings

FED-01M: Incorrect Data Usage

Type	Severity	Location
Logical Fault		FractionERC20DataManager.sol:L113, L115

Description:

The FractionERC20DataManager::partiallyUnlockWrappedAssets function will burn the fractions of the caller prior to measuring the FractionERC20DataManager::localMintBurnSupply thereby calculating the user's proportion incorrectly as the value of the supply would have had the fractions of the user subtracted.

Impact:

The percentage owed to a user when partially unwrapping through the FractionERC20DataManager::partiallyUnlockWrappedAssets function is inflated and will tap into other users' funds.

Example:

Copy
111/// @inheritdoc IFraction
112function partiallyUnlockWrappedAssets(uint256 fractionsToBurn, bool skipNonPercentageWtypes, address beneficiary) external onlyPrimaryChain {
113    burnFrom(_msgSender(), fractionsToBurn);
114
115    uint256 percentage = (fractionsToBurn * 1 ether) / localMintBurnSupply();
116
117    IWrapper(wrapper).percentageBeneficiaryPartiallyUnwrapAssets(nftId, percentage, skipNonPercentageWtypes, beneficiary);
118
119    emit WrappedAssetsUnlocked(nftId, beneficiary, percentage);
120}

Recommendation:

We advise the system to measure the supply prior to performing the burn operation, ensuring that the user's percentage owed has been correctly calculated.

Alleviation (c6b23c23d8bcd8cce85049ad959cbd711a37126b):

The code's statements were re-ordered to ensure that the percentage is calculated prior to the burn operation, alleviating this exhibit in full.