Merge pull request #23 from Blueberryfi/sherlock-audit-fix-115

Blueberryfi · May 18, 2023 · eebdc53 · eebdc53
2 parents f119662 + cdc2655
commit eebdc53
Show file tree

Hide file tree

Showing 2 changed files with 41 additions and 3 deletions.
diff --git a/contracts/BlueBerryBank.sol b/contracts/BlueBerryBank.sol
@@ -408,8 +408,10 @@ contract BlueBerryBank is
             (address[] memory tokens, uint256[] memory rewards) = IERC20Wrapper(
                 pos.collToken
             ).pendingRewards(pos.collId, pos.collateralSize);
-            for (uint256 i; i < tokens.length; i++) {
-                rewardsValue += oracle.getTokenValue(tokens[i], rewards[i]);
+            for (uint256 i; i < tokens.length; i++) {                
+                if (oracle.isTokenSupported(tokens[i])) {
+                    rewardsValue += oracle.getTokenValue(tokens[i], rewards[i]);
+                }
             }
 
             return collValue + rewardsValue;

diff --git a/test/bank.test.ts b/test/bank.test.ts
@@ -913,7 +913,43 @@ describe('Bank', () => {
         await expect(
           bank.getCurrentPositionInfo()
         ).to.be.revertedWith("BAD_POSITION")
-      })
+      })            
+      it("should not reverted getPositionValue view function call when reward token oracle route is set wrongly", async () => {
+        const depositAmount = utils.parseUnits('100', 18);
+        const borrowAmount = utils.parseUnits('300', 6);
+        const iface = new ethers.utils.Interface(SpellABI);
+
+        await usdc.approve(bank.address, ethers.constants.MaxUint256);
+        await ichi.approve(bank.address, ethers.constants.MaxUint256);
+        await bank.execute(
+          0,
+          spell.address,
+          iface.encodeFunctionData("openPositionFarm", [{
+            strategyId: 0,
+            collToken: ICHI,
+            borrowToken: USDC,
+            collAmount: depositAmount,
+            borrowAmount: borrowAmount,
+            farmingPoolId: ICHI_VAULT_PID
+          }])
+        )
+
+        // set ICHI token oracle route wrongly
+        oracle.setRoutes(
+          [ICHI],
+          [ICHI]
+        );
+
+        const positionId = (await bank.nextPositionId()).sub(1);
+        const positionValue = await bank.getPositionValue(positionId);
+        expect(positionValue).to.be.gte(BigNumber.from(0));
+
+        // set ICHI token oracle route correctly
+        oracle.setRoutes(
+          [ICHI],
+          [mockOracle.address]
+        );
+      })    
     })
   })
 })