First Flight #21: KittyFi
First Flight #21
Beginner FriendlyDeFiFoundry
100 EXP
View results
Previous Next
Submission Details
Severity: high
Invalid

Wrong Calculation in getUserVaultMeowllateralInEuros function

pro_king

Description

In the getUserVaultMeowllateralInEuros function, there is a calculation error that causes incorrect output. The current implementation results in significantly inflated values due to incorrect handling of the EXTRA_DECIMALS constant.

function getUserVaultMeowllateralInEuros(address _user) external view returns (uint256) {
(, int256 collateralToUsdPrice,,,) = i_priceFeed.latestRoundData();
(, int256 euroPriceFeedAns,,,) = i_euroPriceFeed.latestRoundData();
// here the calculations are wrong and it gives wrong output if we consider 1 tokne by 2 USD and tokens are 500 so it should give as the result 1000 USD and 1200 EURO but the calculation is wrong and give us 10000 USD and 12000 EURO.
// collateralAns = 500 * (20000000000 * 1e10) / 1e18
// collateralAns = 500 * 200000000000000000000 / 1e18
// collateralAns = 10000000000000000000000 / 1e18
// collateralAns = 10000 USD
​
uint256 collateralAns =
getUserMeowllateral(_user).mulDiv(uint256(collateralToUsdPrice) * EXTRA_DECIMALS, PRECISION);
​
// the above line must be like below to produce the correct answer
// uint256 collateralAns = getUserMeowllateral(_user).mulDiv(uint256(collateralToUsdPrice), PRECISION / EXTRA_DECIMALS);
​
// collateralAns = 10000 * (12000000000 * 1e10) / 1e18
// collateralAns = 10000 * 120000000000000000000 / 1e18
// collateralAns = 1200000000000000000000 / 1e18
// collateralAns = 12000 Euros
// as well as return line will be like below if not then this calculate the wrong number
// return collateralAns.mulDiv(uint256(euroPriceFeedAns), PRECISION / EXTRA_DECIMALS);
​
// collateralAns = 500 * 20000000000 / (1e18 / 1e10)
// collateralAns = 500 * 20000000000 / 1e8
// collateralAns = 500 * 200
// collateralAns = 100000 / 100
// collateralAns = 1000 USD
​
// collateralAns = 1000 * 12000000000 / (1e18 / 1e10)
// collateralAns = 1000 * 12000000000 / 1e8
// collateralAns = 1000 * 120
// collateralAns = 100000 / 100
// collateralAns = 1200 Euros
return collateralAns.mulDiv(uint256(euroPriceFeedAns) * EXTRA_DECIMALS, PRECISION);
}
​

Impact

Incorrect calculations of collateral values in euros can lead to incorrect financial data being displayed or used within the smart contract, which can undermine the integrity of the system and lead to potential financial discrepancies.

Tools Used

Manual Review

Recommendations

To address this issue, correct the calculation of collateralAns by ensuring the proper handling of the EXTRA_DECIMALS constant.

Here is the corrected version of the getUserVaultMeowllateralInEuros function:

function getUserVaultMeowllateralInEuros(address \_user) external view returns (uint256) {\
(, int256 collateralToUsdPrice,,,) = i\_priceFeed.latestRoundData();\
(, int256 euroPriceFeedAns,,,) = i\_euroPriceFeed.latestRoundData();
​
// Correct the calculation for USD collateral value
uint256 collateralAns = getUserMeowllateral(_user).mulDiv(uint256(collateralToUsdPrice), PRECISION / EXTRA_DECIMALS);
​
// Correct the calculation for EUR collateral value
return collateralAns.mulDiv(uint256(euroPriceFeedAns), PRECISION / EXTRA_DECIMALS);

}

Updates

Lead Judging Commences

shikhar229169 Lead Judge about 1 year ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.