Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Rounding Discrepancies in Referral Bonus Calculations Leading to Platform Fee Loss

swapnaliss

Vulnerability Details:

The _updateReferralBonus function exhibits rounding inconsistencies between bonus computations and the remaining fee calculations. This misalignment can lead to minor discrepancies in the final amounts.

Impact:

Over time, these rounding discrepancies may cause a gradual but noticeable loss in platform fees. Although each individual instance may be minor, the aggregate effect could become substantial.

Proof of concept:

The following illustrates the rounding issue:
Link to code

function demonstrateReferralRoundingIssue(
uint256 platformFee,
uint256 referrerRate,
uint256 authorityRate
) public pure returns (uint256, uint256, uint256) {
uint256 referrerBonus = platformFee.mulDiv(referrerRate, 10000, Math.Rounding.Floor);
uint256 authorityBonus = platformFee.mulDiv(authorityRate, 10000, Math.Rounding.Floor);
uint256 inconsistentRemaining = platformFee - referrerBonus - authorityBonus;
uint256 consistentRemaining = platformFee.mulDiv(10000 - referrerRate - authorityRate, 10000, Math.Rounding.Floor);
return (inconsistentRemaining, consistentRemaining, platformFee);
}
​
// Example:
// demonstrateReferralRoundingIssue(10000, 1000, 500)
// Might return (8500, 8499, 10000), showing a 1 wei discrepancy

Tools Used

Recommendations:

Ensure consistent rounding across all related calculations:

remainingPlatformFee = platformFee.mulDiv(
Constants.REFERRAL_RATE_DECIMAL_SCALER - referralInfo.referrerRate - referralInfo.authorityRate,
Constants.REFERRAL_RATE_DECIMAL_SCALER,
Math.Rounding.Floor
);

Consider tracking and redistributing minor rounding discrepancies periodically to prevent cumulative losses.

Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-Rounding-Direction

Duplicate of #456, however, for issues noting rounding directions, will be low severity given the impact is not proven sufficiently with a PoC/numerical example and most rounding will not result in significant losses e.g. most examples only proved at most a 1 wei difference when computing `depositAmount/platFormFees` and involves lower amount offers

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.