Summary

Solidity truncates the result of integer division, which means that performing division before multiplication can result in a loss of precision.

Vulnerability Details

1. collateralAdjustedForThreshold = (collateralValueInUsd * LIQUIDATION_THRESHOLD) / 100

2. (collateralAdjustedForThreshold * 1e18) / totalDscMinted

In step 1, the multiplication inside the parentheses is performed first, followed by the division. In step 2, the multiplication is performed on the result of the division from step 1. Performing a multiplication on the result of a division can lead to precision loss and rounding errors.

Impact

An incorrect value can be returned to the calling function _healthFactor.

Tools Used

Slither static analysis and manual code review.

Recommendations

The equations can be rewritten to avoid performing a multiplication on the result of a division:

collateralAdjustedForThreshold = (collateralValueInUsd * LIQUIDATION_THRESHOLD * 1e18) / (100 * totalDscMinted)

The multiplication and division operations are performed from left to right, avoiding the issue of performing a multiplication on the result of a division.