First Flight #17: Dussehra

Description:

The calculation of totalAmountGivenToRam in Dussehra::killRavana is based on the number of participants multiplied by the entrance fee. Due to the fact that Solidity does not support decimal value and non-integer values are truncated downward.

Impact:

There is a possibility of precision loss and certain amounts of funds being lost.

Proof of Concept:

If the totalAmountByThePeople is an odd number (e.g. 7 participants x 1111 wei fee = 7777 wei), totalAmountGivenToRam = (7777*50)/100 = 3888.5 wei, which will be truncated to 3888 wei, thus losing 1 wei per each case.

Recommended Mitigation:

Although highly unlikely, there is a possibility for the fee to be an odd number.
Use a library that supports fixed-point arithmetic in Solidity.

Tools Used

Manual review