Submission Details
Severity:
Precision loss leads to users paying less for liquidated tokens.
Summary
Current calculation of costInEuros in distributeAssets incurs an unnecessary precision loss due to division before multiplication.
Vulnerability details
uint256 _portion = (asset.amount * _positionStake) /
stakeTotal;
uint256 costInEuros = (((_portion *
10 ** (18 - asset.token.dec) *
uint256(assetPriceUsd)) / uint256(priceEurUsd)) *
_hundredPC) / _collateralRate;
if (costInEuros > _position.EUROs) {
_portion =
(_portion * _position.EUROs) /
costInEuros;
costInEuros = _position.EUROs;
}
Impact
User will have to pay less in EURO for the tokens.
Tools used
VScode, Manual Review
Recommendations
Consider changing it to
uint256 costInEuros = ((_portion * 10 ** (18 - asset.token.dec) * uint256(assetPriceUsd) * _hundredPC) / ( (uint256(priceEurUsd)) * _collateralRate))
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
60933
USDC / LOC
17,500 USDC
2,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.