Tadle
Tadle
DeFiFoundry
27,750 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

During `relistOffer()`, `getRefundAmount()` should round up

Bauer

Summary

In relistOffer(), the calculation for the depositAmount to be taken from the user is rounded down, which is inconsistent with the rounding-up logic in listOffer().

Vulnerability Details

In the listOffer() function, if makerInfo.offerSettleType == OfferSettleType.Protected, the protocol calculates the transferAmount required by the user using a rounding-up method, as shown in the code.

uint256 transferAmount = OfferLibraries.getDepositAmount(
offerInfo.offerType,
offerInfo.collateralRate,
_amount,
true,
Math.Rounding.Ceil
);
​

In the relistOffer() function, the protocol calls OfferLibraries.getRefundAmount() to calculate the depositAmount required from the user.

uint256 depositAmount = OfferLibraries.getRefundAmount(
offerInfo.offerType,
offerInfo.amount,
offerInfo.points,
offerInfo.usedPoints,
offerInfo.collateralRate
);
​
​

In the getRefundAmount() function, we find that usedAmount is rounded up, and if _offerType == OfferType.Bid, the final returned amount (_amount - usedAmount) will be smaller than expected. If _offerType != OfferType.Bid, the protocol rounds down the calculation. This behavior is inconsistent with the logic in listOffer().

uint256 usedAmount = Math.mulDiv(
_amount,
_usedPoints,
_points,
Math.Rounding.Ceil
);
​
if (_offerType == OfferType.Bid) {
return _amount - usedAmount;
}
​
return
Math.mulDiv(
_amount - usedAmount,
_collateralRate,
Constants.COLLATERAL_RATE_DECIMAL_SCALER,
Math.Rounding.Floor
);
​

Impact

The transfer of refund tokens from the user to the capital pool is insufficient.

Tools Used

Recommendations

The recommended fix is to ensure that getRefundAmount() rounds up during relistOffer().

Updates

Lead Judging Commences

0xnevi Lead Judge about 1 year ago
Submission Judgement Published
Validated
Assigned finding tags:

finding-PreMarkets-Rounding-Direction

Duplicate of #456, however, for issues noting rounding directions, will be low severity given the impact is not proven sufficiently with a PoC/numerical example and most rounding will not result in significant losses e.g. most examples only proved at most a 1 wei difference when computing `depositAmount/platFormFees` and involves lower amount offers

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.