Submission Details
Severity:
LiquidationPool::position has loss of precision due to divide before multiply
Summary
Performing multiplication before division is generally better to avoid loss of precision because Solidity integer division might truncate.
Vulnerability Details
In the LiquidationPool::position() function, while computing the Euros, the priority for multiplication before division in the logic is not enforced.
This could lead to loss in precision.
In the below call, the position.TST / getTstTotal() happening before multiplying with balanceOf Euros will result in truncated result.
if (_position.TST > 0) _position.EUROs += IERC20(EUROs).balanceOf(manager) * _position.TST / getTstTotal();
Impact
Loss of fractional position
Tools Used
Manual review
Recommendations
Specify the order of execution of mathematical operators using braces.
if (_position.TST > 0) _position.EUROs += (IERC20(EUROs).balanceOf(manager) * _position.TST) / getTstTotal();
Updates
Lead Judging Commences
hrishibhat over 1 year ago
Submission Judgement Published Reason: Incorrect statement
Assigned finding tags:
informational/invalid
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
60933 USDC / LOC
17,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.