TempleGold
TempleDAO
Foundry
25,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

In `DaiGoldAuction::claim` function claim amount can be truncated

marswhitehacker

Summary

In DaiGoldAuction::claim the function claim amount can be truncated if the user deposited a small amount of DAI, but all users have deposited a big amount of DAI for a short period

Vulnerability Details

If one particular user invests a small amount of DAI, and the overall investment of DAI is very huge amount, and the auction has started after the previous one right after the time diff passed, this formula can truncate and lose users invested amount:

uint256 claimAmount = bidTokenAmount.mulDivRound(info.totalAuctionTokenAmount, info.totalBidTokenAmount, false);

Here claim amount would be zero if bidTokenAmount * totalAuctionTokenAmount is less than totalBidTokenAmount

Impact

User can lose some wei if deposited them

Tools Used

Manual review

Recommendations

Use more decimals in a formula for numerator

Updates

Lead Judging Commences

inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.