In the deposit
function of the CommunityVCS
contract, there is an arithmetic operation where division is performed before multiplication. This can cause precision loss due to the nature of integer division in Solidity, which truncates decimal values. The issue arises when calculating the number of vaults per group, potentially leading to an inaccurate distribution of resources across vault groups.
The problematic section of code is as follows:
Here, the division of totalVaults / numVaultGroups
occurs before the multiplication by diff
.
In Solidity, division truncates any remainder when dealing with integers, leading to potential loss of precision. As a result, the number of vaults per group may not be distributed evenly, which can affect how much deposit capacity is allocated to each vault.
Let’s assume the following values:
totalVaults = 17
numVaultGroups = 3
If we perform the division first (17 / 3
), the result would be 5
(truncated from 5.67
), meaning some vault groups may receive less than their fair share of deposits. Multiplying this truncated result by diff
may further compound the inaccuracy, leading to inefficient vault utilization.
In contrast, performing the multiplication first would retain more precision, as shown in the corrected calculation below.
Inefficient Resource Distribution: The division before multiplication can cause some vaults to receive more deposit capacity than others, resulting in an uneven allocation of staking resources.
Potential Underutilization: Vaults may become underutilized or overburdened, leading to inefficiencies in staking operations, which can impact the system's performance and user experience.
Staking Discrepancies: Over time, small inaccuracies can accumulate, leading to larger imbalances in how deposits are distributed across vault groups.
Manual code review
Static analysis
To avoid precision loss, reverse the order of operations by performing the multiplication first, ensuring more accurate calculations:
This change ensures that the multiplication happens before division, reducing the chance of losing precision during the calculations. By doing so, the vaults will be allocated more fairly, and the staking system will perform more efficiently.
The contest is live. Earn rewards by submitting a finding.
This is your time to appeal against judgements on your submissions.
Appeals are being carefully reviewed by our judges.