Summary

A precision issue was identified in the steak points calculation system, potentially leading to inaccuracies in user point balances.

Vulnerability Details

The current implementation uses JavaScript's native number type for calculations, which can lead to precision loss when dealing with large numbers or fractional values. This is particularly problematic when calculating steak points from Ether amounts.

For example, consider a user staking 0.512345678912345678 ETH:

The difference in points awarded would be:

This difference may seem small for a single transaction, but it can accumulate to significant discrepancies over multiple transactions or with larger amounts.

Impact

Users may receive incorrect steak point allocations, potentially leading to unfair distribution of rewards or benefits in the system.

Tools Used

Manual code review

Recommendations

• Use a high-precision decimal library (e.g., decimal.js) for calculations:

• Update the MongoDB schema to use a Decimal (Decimal128 under the hood) type for storing points:

• Update the package.json to include the new dependency: