TokenMigrator Manual Review Findings

TMR-01M: Favourable Conversion Rate

Type	Severity	Location
Mathematical Operations		TokenMigrator.sol:L148-L151

Description:

Due to the way the wxBTRFLY token works, a conversion from (x)BTRFLY to wBTRFLY (wBTRFLYValue) will truncate causing the wBTRFLY to (x)BTYRFLY conversion (xBTRFLYValue) to yield one unit less than the original input amount. Given that ultimately the wBTRFLY evaluation is utilized for minting the BTRFLY V2 token, it is favourable for users to wrap their tokens in wxBTRFLY and then convert them.

Example:

Copy
148if (wxAmount != 0) {
149    burnAmount += wxBtrfly.xBTRFLYValue(wxAmount);
150    mintAmount += _migrateWxBtrfly(wxAmount);
151}
152
153if (xAmount != 0) {
154    burnAmount += xAmount;
155    mintAmount += _migrateXBtrfly(xAmount);
156}
157
158if (v1Amount != 0) {
159    burnAmount += v1Amount;
160    mintAmount += _migrateBtrfly(v1Amount);
161}

Recommendation:

While the degree to which users gain a benefit from this action is miniscule, we advise this behaviour to be documented via in-line comments warning that due to truncations, the same BTRFLY amount may yield different results depending on the form (normal, x and wx) utilized for the conversion.

Alleviation:

The Redacted Cartel team introduced a property-based test in their repository to invalidate this finding as truncation never affects the converted amounts based on the test. We would like to note that the wBTRFLYValue function of wxBTRFLY performs a division with the result of realIndex. This causes a truncation as long as the amount is equivalent to n * realIndex() - 1 where n is a number greater-than-or-equal-to (>=) two. Please test and ensure that the above does not occur in which case we will nullify this finding.