Submission Details
Severity:
FERTILIZER_AMOUNT_PRECISION is not used for precision of fertilizer in _getMintFertilizerOut
Summary
The precision constant FERTILIZER_AMOUNT_PRECISION isn't utilized in FertilizerFacet::_getMintFertilizerOut().
Impact
This results in minted fertilizer amounts being significantly lower than expected.
Vulnerability Details
For instance, if FERTILIZER_AMOUNT_PRECISION is not applied in the calculation, a token input of 1 may yield only 0.000001 fertilizer instead of the expected 1.
Tools Used
Manual review
Recommendations
use FERTILIZER_AMOUNT_PRECISION in FertilizerFace::_getMintFertilizerOut()
function _getMintFertilizerOut(
uint256 tokenAmountIn,
address barnRaiseToken
) public view returns (uint256 fertilizerAmountOut) {
fertilizerAmountOut = tokenAmountIn.div(
LibUsdOracle.getUsdPrice(barnRaiseToken)
-- );
++ ).mul(FERTILIZER_AMOUNT_PRECISION);
}
Updates
Lead Judging Commences
giovannidisiena over 1 year ago
Submission Judgement Published Reason: Incorrect statement
Assigned finding tags:
Informational/Invalid
Prize pool breakdown
Total prize
35,000 USDC
nSLOC
1,99118 USDC / LOC
30,000 USDC
1,500 USDC
3,500 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.