DittoETH
Ditto
DeFiFoundryOracle
55,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

The calculation of the twapPriceInEther divides first and multiplies after which can lead to precision loss and would result in a DoS if WETH would be below one dollar in the future

cosine

Summary

The twapPriceInEther calculation should multiply first and divide after, or otherwise the calculation could lead to precision loss and would be rounded to zero if WETH is worth less than a dollar in the future.

Vulnerability Details

This is the formula to calculate the twapPriceInEther:

uint256 twapPriceInEther = (twapPrice / Constants.DECIMAL_USDC) * 1 ether;

The twapPrice is divided by the 10 ** 6 and multiplied by 1e18 after that. Dividing first can lead to precision loss, also if WETH would be for any reason below one dollar in the future the twapPrice would be below 10 ** 6 and therefore the calculation would be rounded down to zero by solidity. This would lead to a DoS, as the following check would revert:

if (twapPriceInEther == 0) {
revert Errors.InvalidTwapPrice();
}

Impact

Precision Loss, DoS

Tools Used

Manual Review

Recommendations

Multiply first and divide after.

Updates

Lead Judging Commences

0xnevi Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-535

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.