Tadle

Summary

incorrect calculation of remaining amount

Vulnerability Details

1. When the offer status is Virgin, the calculation is correct: the remaining amount is the full offer amount.

2. However, when the offer status is not Virgin (which in this case would be Canceled), the calculation is incorrect.

The current calculation for the non-Virgin case is:

remainingAmount = offerInfo.amount * (usedPoints / points)

This is wrong because it calculates the amount that has been used, not the amount remaining

To calculate the remaining amount correctly, we need to subtract the used amount from the total amount. The correct calculation should be:

remainingAmount = offerInfo.amount.mulDiv(
offerInfo.points - offerInfo.usedPoints,
offerInfo.points,
Math.Rounding.Floor
);

Impact

incorrect calculation of remaining amount

Tools Used

Manual Review

Recommendations

remainingAmount = offerInfo.amount.mulDiv(
offerInfo.points - offerInfo.usedPoints,
offerInfo.points,
Math.Rounding.Floor
);