Submission Details
Severity:
Division before multiplication results in lower `dittoMatchedShares` distributed to users
Summary
Shares amount is rounded down to number of days staked. Max truncation is 1 day, min time is 14 days. At most 1 / 14 * 100% = 7.1% of accrued shares will be truncated.
Vulnerability Details
Division before multiplication
uint88 shares = eth * (timeTillMatch / 1 days);
Suppose timeTillMatch = 14.99 days, eth = 1e18. Expected result is 14.99 * 1e18 / 1 = 14.99e18 shares. Actual result is 1e18 * (14.99 / 1) = 14e18 shares
Impact
Up to 7.1% of user's shares will be truncated
Tools Used
Manual Review
Recommendations
- uint88 shares = eth * (timeTillMatch / 1 days);
+ uint88 shares = uint88(uint256(eth * timeTillMatch) / 1 days);
Prize pool breakdown
Total prize
55,000 USDC
nSLOC
3,36516 USDC / LOC
50,000 USDC
5,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.