DittoETH

Ditto
DeFiFoundryOracle
55,000 USDC
View results
Submission Details
Severity: medium
Invalid

Lack of Precision Check in increaseCollateral and decreaseCollateral Functions

Summary

Lack of Precision Check in increaseCollateral and decreaseCollateral Functions

Vulnerability Details

The contract fails to verify whether the specified amount in the increaseCollateral and decreaseCollateral functions aligns with the precision limits of the underlying asset. This oversight may result in rounding discrepancies during the conversion of the amount to the asset's smallest unit for storage or computations.

Impact

It could potentially impact the accuracy of the contract's state and the balances of the users.

Tools Used

Manual

Recommendations

To resolve this issue, you should add a precision check in the increaseCollateral and decreaseCollateral functions. This check should ensure that the specified amount aligns with the precision limits of the underlying asset.

Here is a sample implementation:

function increaseCollateral(address asset, uint8 id, uint88 amount)
external
isNotFrozen(asset)
nonReentrant
onlyValidShortRecord(asset, msg.sender, id)
{
require(amount % 1e18 == 0, "Amount must align with asset precision");
// Rest of the function implementation
}
function decreaseCollateral(address asset, uint8 id, uint88 amount)
external
isNotFrozen(asset)
nonReentrant
onlyValidShortRecord(asset, msg.sender, id)
{
require(amount % 1e18 == 0, "Amount must align with asset precision");
// Rest of the function implementation
}

In this example, 1e18 is used as the precision for Ether. If the underlying asset has a different precision, you should replace 1e18 with the appropriate value. This will ensure that the amount is always a multiple of the smallest unit of the asset, preventing any rounding discrepancies.

Updates

Lead Judging Commences

0xnevi Lead Judge
over 1 year ago
0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Other

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.