TempleGold
TempleDAO
Foundry
25,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

dust can stay in DaiGoldAuction, SpiceAuction and TempleGoldStaking contract

cryptomoon

Summary

Dust of tokens can stay in DaiGoldAuction, SpiceAuctiondue to rounding down.

Vulnerability Details

Users can claim their templeGoldToken and spiceToken rewards by calling claim. The function determine claimAmountas following. Due to this rounding down, the dust will stay in the contract.

https://github.com/Cyfrin/2024-07-templegold/blob/main/protocol/contracts/templegold/SpiceAuction.sol#L221

uint256 claimAmount = bidTokenAmount.mulDivRound(info.totalAuctionTokenAmount, info.totalBidTokenAmount, false);

Other instances in the codebase:

https://github.com/Cyfrin/2024-07-templegold/blob/main/protocol/contracts/templegold/DaiGoldAuction.sol#L161

Impact

Dust will stay in the contract

Tools Used

Manual review

Recommendations

There are several solutions for this. One simple way is to round up for last claimer.

Updates

Lead Judging Commences

inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.