CYBRO security record

In rebalanceAuto(), It automatically rebalances assets across all lending pools part of what it does is iterate through all lending pool with a for loop, executing redeem on each pool and then swapping it to the pool asset, However it never checks the amount returned on the redeem() to be above 0 before executing the swap as it is a possibility for one of the pool being iterated on to return 0 on redeem and also since the redeem function default is to round down. This unhandled zero amount going into a swap will always revert the entire rebalanceAuto(). Therefore, if one of the pool.redeem() returns zero the entire rebalanceAuto() will fail.

Unlike in _applyWithdrawalFee where fee > 0 is first checked before making a transfer, _applyPer formanceFee does not check if fee > 0 before making the performancefee transfer, this will cause operations that makes call to _applyPerformanceFee to revert for some tokens for cases when fee returned is zero. Transferring performance fee without checking if fee > 0 could cause the entire parent operations to revert for some tokens.

user fees properly if getUpdateUserFees() has not been called before. When setFeesForUsers() is executed:. The function sets the user’s fees using Math.min() with the default uninitialized value (0) from _users[user]. . Since userFees.depositFee, userFees.withdrawalFee, and userFees.performanceFee are not initial ized, they default to 0. . As a result, the user’s fees are always set to 0, overriding the global fee settings. . getUpdateUserFees() is expected to initialize fees, but if setFeesForUsers() is called first, the fees will remain 0.