Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Inconsistent Rounding in Deposit Amount Calculations

thopatevijay

Vulnerability Details

In the _depositTokenWhenCreateTaker function, there's an inconsistency in rounding that could lead to slightly incorrect deposit amounts. The getDepositAmount function uses Math.Rounding.Ceil, but additional fees are added without considering potential rounding errors.

Impact

This inconsistency could result in users paying slightly more than necessary for their deposits. Over time and with many transactions, this could lead to a small but unfair accumulation of excess funds in the contract.

Tools Used

Link to code

function demonstrateRoundingInconsistency(
uint256 depositAmount,
uint256 collateralRate,
uint256 platformFee,
uint256 tradeTax
) public pure returns (uint256, uint256) {
uint256 baseAmount = depositAmount.mulDiv(collateralRate, 10000, Math.Rounding.Ceil);
uint256 inconsistentTotal = baseAmount + platformFee + tradeTax;
uint256 consistentTotal = (depositAmount + platformFee + tradeTax).mulDiv(collateralRate, 10000, Math.Rounding.Ceil);
return (inconsistentTotal, consistentTotal);
}
​
// Example:
// demonstrateRoundingInconsistency(10000, 10100, 50, 30)
// Might return (10150, 10151), showing a 1 wei difference

Recommendations

  • Apply consistent rounding throughout the calculation:

uint256 transferAmount = OfferLibraries.getDepositAmount(
offerInfo.offerType,
offerInfo.collateralRate,
depositAmount + platformFee + tradeTax,
false,
Math.Rounding.Ceil
);

  • Alternatively, consider using a more precise calculation method that minimizes rounding errors.

Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-Rounding-Direction

Duplicate of #456, however, for issues noting rounding directions, will be low severity given the impact is not proven sufficiently with a PoC/numerical example and most rounding will not result in significant losses e.g. most examples only proved at most a 1 wei difference when computing `depositAmount/platFormFees` and involves lower amount offers

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.