The Standard

The Standard
DeFiHardhat
20,000 USDC
View results
Submission Details
Severity: low
Valid

`LiquidationPool::distributeAssets` Round-Down Issue Excludes Small Stakers from Receiving Tokens

Description

The problematic line in LiquidationPool::distributeAssets is as follows:

uint256 _portion = (asset.amount * _positionStake) / stakeTotal;

If a vault holds a small amount (numerically) of an asset with a few decimals (e.g., 6 like USDC or 8 like WBTC), the result of the portion calculation will be 0 for small stakers due to rounding down.

Example for 0.01 WBTC (467$):

0.01e8 WBTC * 10 TST_EUR / 11_000_000 = 1e7 / 1.1e7 = 0

Impact

This may result in only large stakers being able to receive tokens with low decimals and/or in small amounts (e.g., 0.01 WBTC, which is considered a substantial amount).

Recommended Mitigation

Several possible solutions include:

  • Warn users in the documentation about the potential limitation.

  • Implement a minimum stake requirement.

  • Avoid using tokens with few decimals.

Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

precision

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.