0xAadi - SuperPool.totalAssets() is not EIP-4626 complaint

[sherlock-admin3]

0xAadi

Medium

SuperPool.totalAssets() is not EIP-4626 complaint

Summary

The totalAssets() function in the SuperPool contract does not fully comply with ERC4626 requirements, as it does not account for accrued interest in its calculation of total managed assets.

Vulnerability Detail

According to eip-4626 totalAssets() MUST be inclusive of any fees that are charged against assets in the Vault.

The totalAssets() function is intended to provide the total amount of underlying assets managed by the vault. However, it currently only sums the balance of assets held directly by the SuperPool and those in the underlying pools, without including any accrued interest(which is inclusive of interest fee). This omission means that the function does not accurately reflect the total assets under management, potentially misleading users about the actual value of the vault's holdings.

Impact

The lack of accrued interest in the totalAssets() calculation can lead to discrepancies in asset reporting, affecting users' understanding of the vault's performance and potentially impacting decisions based on the vault's reported assets. This could result in financial miscalculations or misrepresentations of the vault's value.

Code Snippet

https://github.com/sherlock-audit/2024-08-sentiment-v2/blob/main/protocol-v2/src/SuperPool.sol#L180

Tool used

Manual Review

Recommendation

Modify the totalAssets() function to include accrued interest in its calculation. This could involve integrating logic from simulateAccrue() to ensure that any interest accrued since the last update is reflected in the total assets reported by the function

Duplicate of #110