Merge pull request #8 from Unstoppable-DeFi/fix-review-44

fix sherlock #44

contracts/Vault.vy

@@ -228,10 +228,15 @@ def register_deposit(_token_id: uint256, _amount: uint256):
     # transfer WETH to self
     ERC20(WETH).transferFrom(msg.sender, self, _amount)
 
+    total_claimable: uint256 = self.total_shares * self.amount_claimable_per_share
+
     # deposit WETH to Alchemix
     shares_issued: uint256 = self._deposit_to_alchemist(_amount)
     position.shares_owned += shares_issued
     self.total_shares += shares_issued
+
+    if self.amount_claimable_per_share > 0:
+        self.amount_claimable_per_share = total_claimable / self.total_shares
 
     self.positions[_token_id] = position
 
@@ -455,6 +460,9 @@ def _claimable_for_token(_token_id: uint256) -> uint256:
         return 0
 
     total_claimable_for_position: uint256 = position.shares_owned * self.amount_claimable_per_share / PRECISION
+    if total_claimable_for_position < position.amount_claimed:
+        return 0
+
     return total_claimable_for_position - position.amount_claimed
 
 

tests/test_Vault_deposit.py

@@ -9,7 +9,7 @@
 
 @pytest.fixture(autouse=True)
 def approve(weth, vault, owner):
-    weth.approve(vault, AMOUNT)
+    weth.approve(vault, AMOUNT*2)
     vault.add_depositor(owner)
 
 
@@ -105,3 +105,33 @@ def test_non_depositor_cannot_call_deposit(vault, alice, nft, owner):
     with boa.env.prank(alice):
         with boa.reverts():
             vault.register_deposit(EXISTING_TOKEN_ID, AMOUNT)
+
+
+def test_amount_claimable_per_share_is_adjusted_on_new_deposits(vault, alice, owner, nft, alchemist, weth):
+    alchemist.eval(f"self.total_value = {2*AMOUNT}")
+    alchemist.eval(f"self.debt = 0")
+
+    nft.DEBUG_transferMinter(owner)
+    nft.mint(owner, EXISTING_TOKEN_ID)
+    nft.mint(alice, EXISTING_TOKEN_ID+1)
+
+    assert vault.amount_claimable_per_share() == 0
+
+    vault.register_deposit(EXISTING_TOKEN_ID, AMOUNT)
+    total_shares_before = vault.total_shares()
+
+    weth.transfer(vault.address, 10 * 10**18)
+    vault.internal._mark_as_claimable(10 * 10**18)
+
+    claimable_before = vault.amount_claimable_per_share() 
+
+    assert claimable_before > 0
+
+    vault.register_deposit(EXISTING_TOKEN_ID+1, AMOUNT)
+
+    total_shares_after = vault.total_shares()
+    claimable_after = vault.amount_claimable_per_share()
+
+    assert total_shares_after == total_shares_before * 2
+
+    assert claimable_after == claimable_before / 2