Brilliant Metal Liger - The `sharesPerToken` change in pool leads to miscalculation of coupon tokens distribution

[sherlock-admin2]

Brilliant Metal Liger

Medium

The sharesPerToken change in pool leads to miscalculation of coupon tokens distribution

Summary

in Pool.sol , when the auction is created, it is using the new sharesPerToken value, which could be updated by the governor before. At the same time, the globalPool.sharesPerToken value in BondToken.sol still has the old value for the corresponding period. This leads to coupon token amount giveaway miscalculation, leading to either loss of coupon funds or underpaid bond token shares amount.

Root Cause

The new value of Pool.sharesPerToken is put into new auction, and corresponding couponAmountToDistribute is calculated using that value. But after increaseIndexedAssetPeriod call, the old globalPool.sharesPerToken value is saved in BondToken.globalPool.previousPoolAmounts[currentPeriod]. The final coupon value accrued in Distributor.claim() will use the old value.

https://github.com/sherlock-audit/2024-12-plaza-finance/blob/main/plaza-evm/src/Pool.sol#L552-L567

Internal Pre-conditions

No response

External Pre-conditions

No response

Attack Path

No response

Impact

1. if coupon > shares, some coupon will be frozen
2. if coupon < shares, some shares will never be paid

PoC

No response

Mitigation

No response