Submission Details
Severity:
LiquidationPool::distributeAssets() division before multiplication can lead to precision loss
Summary and Vulnerability Details
The distributeAssets() function in the LiquidationPool contract performs a division before multiplication.
Solidity's integer division truncates. Thus, performing division before multiplication can lead to precision loss and should be avoided
Impact
Solidity's integer division truncates and can lead to false calculations due to precision loss
Tools Used
Manual Review
Recommendations
Perform multiplications before any divisions and use the following formula:
uint256 costInEuros = (_portion * 10 ** (18 - asset.token.dec) * uint256(assetPriceUsd) * _hundredPC) / uint256(priceEurUsd) / _collateralRate;
instead of:
uint256 costInEuros = _portion * 10 ** (18 - asset.token.dec) * uint256(assetPriceUsd) / uint256(priceEurUsd) * _hundredPC / _collateralRate;
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
60933 USDC / LOC
17,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.