Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Rounding Inconsistency in Referral Bonus Calculations Leading to Fee

thopatevijay

Vulnerability Details

In the _updateReferralBonus function, there's an inconsistency in rounding between the bonus calculations and the remaining fee calculation. This could lead to small discrepancies in the final amounts.

Impact

Over time and with many transactions, this inconsistency could result in a small but persistent loss of platform fees. While each instance might be negligible, the cumulative effect could be significant.

Proof of Concept

Link to code

function demonstrateReferralRoundingIssue(
uint256 platformFee,
uint256 referrerRate,
uint256 authorityRate
) public pure returns (uint256, uint256, uint256) {
uint256 referrerBonus = platformFee.mulDiv(referrerRate, 10000, Math.Rounding.Floor);
uint256 authorityBonus = platformFee.mulDiv(authorityRate, 10000, Math.Rounding.Floor);
uint256 inconsistentRemaining = platformFee - referrerBonus - authorityBonus;
uint256 consistentRemaining = platformFee.mulDiv(10000 - referrerRate - authorityRate, 10000, Math.Rounding.Floor);
return (inconsistentRemaining, consistentRemaining, platformFee);
}
​
// Example:
// demonstrateReferralRoundingIssue(10000, 1000, 500)
// Might return (8500, 8499, 10000), showing a 1 wei discrepancy

Tools Used

Manual Review

Recommendations

  • Use consistent rounding throughout the calculation:

remainingPlatformFee = platformFee.mulDiv(
Constants.REFERRAL_RATE_DECIMAL_SCALER - referralInfo.referrerRate - referralInfo.authorityRate,
Constants.REFERRAL_RATE_DECIMAL_SCALER,
Math.Rounding.Floor
);

  • Alternatively, consider accumulating small rounding errors in a separate variable and redistributing them periodically to ensure no value is lost over time.

Updates

Lead Judging Commences

0xnevi Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-Rounding-Direction

Duplicate of #456, however, for issues noting rounding directions, will be low severity given the impact is not proven sufficiently with a PoC/numerical example and most rounding will not result in significant losses e.g. most examples only proved at most a 1 wei difference when computing `depositAmount/platFormFees` and involves lower amount offers

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.