Liquid Staking
Stakelink
DeFiHardhatOracle
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Precision Loss in Fee Calculation

pro_king

Summary

In the StakingPool::_updateStrategyRewards function, there is a potential issue of precision loss during the calculation of fees based on rewards and shares. The fee amounts are calculated by multiplying the rewards with a basis point value, which can lead to loss of precision, particularly when dealing with large amounts or significant scaling of token values. Although this issue may not severely affect normal operations, it can result in minor discrepancies in share minting.

Vulnerability Detail

The issue arises when rewards are distributed to strategies and fee amounts are calculated. Specifically, the multiplication and division operations, such as:

and the minting of shares:

​
uint256 sharesToMint = (totalFeeAmounts * totalShares) / (totalStaked - totalFeeAmounts);

can cause precision loss due to Solidity's integer math operations. Since Solidity does not handle floating-point arithmetic, any fractional values from the division are truncated, resulting in slightly inaccurate fee amounts and shares calculations.

Impact

The precision loss could lead to:

  1. Potential under-allocation or over-allocation of shares.

  2. Discrepancies in the total fee amounts and rewards calculated across strategies.

Code Snippet

function _updateStrategyRewards(uint256[] memory _strategyIdxs, bytes memory _data) private {
int256 totalRewards;
uint256 totalFeeAmounts;
uint256 totalFeeCount;
address[][] memory receivers = new address[][]();
uint256[][] memory feeAmounts = new uint256[][]();
​
// sum up rewards and fees across strategies
for (uint256 i = 0; i < _strategyIdxs.length; ++i) {
IStrategy strategy = IStrategy(strategies[_strategyIdxs[i]]);
​
(
int256 depositChange,
address[] memory strategyReceivers,
uint256[] memory strategyFeeAmounts
) = strategy.updateDeposits(_data);
totalRewards += depositChange;
​
if (strategyReceivers.length != 0) {
receivers[i] = strategyReceivers;
feeAmounts[i] = strategyFeeAmounts;
totalFeeCount += receivers[i].length;
for (uint256 j = 0; j < strategyReceivers.length; ++j) {
totalFeeAmounts += strategyFeeAmounts[j];
}
}
}
​
// update totalStaked if there was a net change in deposits
if (totalRewards != 0) {
// follow-up for casting
totalStaked = uint256(int256(totalStaked) + totalRewards);
}
​
// calulate fees if net positive rewards were earned
if (totalRewards > 0) {
receivers[receivers.length - 1] = new address[]();
feeAmounts[feeAmounts.length - 1] = new uint256[]();
totalFeeCount += fees.length;
​
for (uint256 i = 0; i < fees.length; i++) {
receivers[receivers.length - 1][i] = fees[i].receiver;
feeAmounts[feeAmounts.length - 1][i] =
(uint256(totalRewards) * fees[i].basisPoints) /
10000;
totalFeeAmounts += feeAmounts[feeAmounts.length - 1][i];
}
}
​
// safety check
if (totalFeeAmounts >= totalStaked) {
totalFeeAmounts = 0;
}
​
// distribute fees to receivers if there are any
if (totalFeeAmounts > 0) {
@>>>> uint256 sharesToMint = (totalFeeAmounts * totalShares) /
(totalStaked - totalFeeAmounts);
_mintShares(address(this), sharesToMint);
​
uint256 feesPaidCount;
for (uint256 i = 0; i < receivers.length; i++) {
for (uint256 j = 0; j < receivers[i].length; j++) {
if (feesPaidCount == totalFeeCount - 1) {
transferAndCallFrom(
address(this),
receivers[i][j],
balanceOf(address(this)),
"0x"
);
} else {
transferAndCallFrom(address(this), receivers[i][j], feeAmounts[i][j], "0x");
feesPaidCount++;
}
}
}
}
​
emit UpdateStrategyRewards(msg.sender, totalStaked, totalRewards, totalFeeAmounts);
}
​

Recommendation

Implemente a more precise reward distribution mechanism that minimizes rounding errors could improve the overall accuracy.

Updates

Lead Judging Commences

inallhonesty Lead Judge 12 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.