Submission Details
Severity:
Division before multiplication for price
Summary
When normalizing the TWAP price we divide it by 1e6 and then multiply by 1e18. The division can round to zero.
Vulnerability Details
If the TWAP price falls below 1e6, it rounds down to zero during division. The protocol aims to add more assets in the future. It's noteworthy that stablecoins (and their derivatives) frequently trade below their peg, resulting in their value being rounded down to zero.
Impact
When the TWAP price is zero, the inverse
uint256 twapPriceInv = twapPriceInEther.inv();
is not defined. Hence any transaction will revert.
Tools Used
VS Code
Recommendations
To fix this, reverse the order of operations - multiply before dividing.
Prize pool breakdown
Total prize
55,000 USDC
nSLOC
3,36516 USDC / LOC
50,000 USDC
5,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.