Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Rounding Discrepancies in Deposit Amount Calculations

swapnaliss

Vulnerability Details:

In the _depositTokenWhenCreateTaker function, rounding inconsistencies can lead to slight inaccuracies in deposit amounts. Specifically, the getDepositAmount function utilizes Math.Rounding.Ceil, but additional fees are added without aligning with this rounding method.

Impact:

These inconsistencies may result in users being charged slightly more than required for their deposits. Although each discrepancy might be small, repeated transactions could cause an unfair accumulation of extra funds within the contract.

proof of Concept:

The following demonstrates the rounding inconsistency:
Link to code

function demonstrateRoundingInconsistency(
uint256 depositAmount,
uint256 collateralRate,
uint256 platformFee,
uint256 tradeTax
) public pure returns (uint256, uint256) {
uint256 baseAmount = depositAmount.mulDiv(collateralRate, 10000, Math.Rounding.Ceil);
uint256 inconsistentTotal = baseAmount + platformFee + tradeTax;
uint256 consistentTotal = (depositAmount + platformFee + tradeTax).mulDiv(collateralRate, 10000, Math.Rounding.Ceil);
return (inconsistentTotal, consistentTotal);
}
​
// Example:
// demonstrateRoundingInconsistency(10000, 10100, 50, 30)
// Might return (10150, 10151), showing a 1 wei difference

Tools Used

Recommendations

Ensure consistent rounding throughout the calculations:

uint256 transferAmount = OfferLibraries.getDepositAmount(
offerInfo.offerType,
offerInfo.collateralRate,
depositAmount + platformFee + tradeTax,
false,
Math.Rounding.Ceil
);

Consider adopting a more precise calculation method to minimize rounding errors.

Updates

Lead Judging Commences

0xnevi Lead Judge 12 months ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-Rounding-Direction

Duplicate of #456, however, for issues noting rounding directions, will be low severity given the impact is not proven sufficiently with a PoC/numerical example and most rounding will not result in significant losses e.g. most examples only proved at most a 1 wei difference when computing `depositAmount/platFormFees` and involves lower amount offers

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.