The Standard
The Standard
DeFiHardhat
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Minor precision loss in the `distributeAssets()` function

auditism

Summary

The distributeAssets() can suffer some minor precision loss when the number assets( _portion ) is low.

Vulnerability Details

When calculating the costInEuros, the calculation can be subject to precision loss if the _portion is low and priceEurUsd is high." and the numerator ends up being lower than 120_000 (the current _collateralRate ).

https://github.com/Cyfrin/2023-12-the-standard/blob/91132936cb09ef9bf82f38ab1106346e2ad60f91/contracts/LiquidationPool.sol#L220-L221

uint256 costInEuros = _portion * 10 ** (18 - asset.token.dec) * uint256(assetPriceUsd) / uint256(priceEurUsd)
* _hundredPC / _collateralRate;

Impact

The protocol absorbs minor loses EUROs.

Tools Used

Manual review

Foundry

Recommendations

If the costInEuros == 0 make sure that the staker cannot get assets for free.

uint256 costInEuros = _portion * 10 ** (18 - asset.token.dec) * uint256(assetPriceUsd) / uint256(priceEurUsd)
* _hundredPC / _collateralRate; //@note why should I be able to use the collateral rate I want, same for hundredPC ? Also, there might be loss of preccision here
if (costInEuros > _position.EUROs) {
_portion = _portion * _position.EUROs / costInEuros; //@note can the portion result be 0 but still be deducted Euros ? so if costInEuros > _portion * _position.EUROs user will lose EURO but not get anything in return
costInEuros = _position.EUROs;
}
if(costInEuros ==0) _portion = 0;
_position.EUROs -= costInEuros;
rewards[abi.encodePacked(_position.holder, asset.token.symbol)] += _portion;
burnEuros += costInEuros;
if (asset.token.addr == address(0)) {
nativePurchased += _portion;
} else {
IERC20(asset.token.addr).safeTransferFrom(manager, address(this), _portion);
}
}
}
​
Updates

Lead Judging Commences

hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

precision

auditism Submitter
over 1 year ago
hrishibhat Lead Judge
over 1 year ago
hrishibhat Lead Judge over 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

precision

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.