Fjord Token Staking
Fjord
DeFiFoundry
20,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Precision loss in token distribution

sabit

Summary

Precision loss in token distribution.

Vulnerability Details

Divisions in the multiplier calculation and claimTokens() function could lead to rounding errors and some tokens being left in the contract.

multiplier = totalTokens.mul(PRECISION_18).div(totalBids);

https://github.com/Cyfrin/2024-08-fjord/blob/0312fa9dca29fa7ed9fc432fdcd05545b736575d/src/FjordAuction.sol#L197

function claimTokens() external {
if (!ended) {
revert AuctionNotYetEnded();
}
​
uint256 userBids = bids[msg.sender];
if (userBids == 0) {
revert NoTokensToClaim();
}
​
uint256 claimable = userBids.mul(multiplier).div(PRECISION_18);
bids[msg.sender] = 0;
​
auctionToken.transfer(msg.sender, claimable);
emit TokensClaimed(msg.sender, claimable);
}

https://github.com/Cyfrin/2024-08-fjord/blob/0312fa9dca29fa7ed9fc432fdcd05545b736575d/src/FjordAuction.sol#L207C4-L222C6

Suppose we have:

  • totalTokens = 1000

  • totalBids = 3

  • PRECISION_18 = 1e18 (1 followed by 18 zeros)

In the auctionEnd() function, we calculate the multiplier:

multiplier = totalTokens.mul(PRECISION_18).div(totalBids);

This gives us:

multiplier = (1000 * 1e18) / 3 = 333333333333333300000

Now, let's say there are three bidders who bid 1 FjordPoint each. When they claim their tokens:

uint256 claimable = userBids.mul(multiplier).div(PRECISION_18);

For each bidder:

claimable = 1 * 333333333333333300000 / 1e18 = 333

So each bidder gets 333 tokens. However, 3 * 333 = 999, meaning 1 token is left unclaimed in the contract due to rounding down in integer division.

Impact

Tokens would be left unclaimed in the contract.

Tools Used

Manual review

Recommendations

There should be a sweep function implemented in the contract.

Updates

Lead Judging Commences

inallhonesty Lead Judge
about 1 year ago
inallhonesty Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

FjordAuction doesn't handle the dust remained after everyone claimed

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.