Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

MembershipFactory.sol :: joinDAO() precission loss in the calculation of platformFees.

ivanfitro

Summary

When calculating platformFees, precision loss occurs due to Solidity's inherent truncation during division. This results in the protocol collecting fewer fees than intended..

Vulnerability Details

joinDAO() is implemented as follows:

function joinDAO(address daoMembershipAddress, uint256 tierIndex) external {
require(daos[daoMembershipAddress].noOfTiers > tierIndex, "Invalid tier.");
require(daos[daoMembershipAddress].tiers[tierIndex].amount > daos[daoMembershipAddress].tiers[tierIndex].minted, "Tier full.");
uint256 tierPrice = daos[daoMembershipAddress].tiers[tierIndex].price;
@> uint256 platformFees = (20 * tierPrice) / 100;
daos[daoMembershipAddress].tiers[tierIndex].minted += 1;
//user pay
IERC20(daos[daoMembershipAddress].currency).transferFrom(_msgSender(), owpWallet, platformFees);
IERC20(daos[daoMembershipAddress].currency).transferFrom(_msgSender(), daoMembershipAddress, tierPrice - platformFees);
//mint ERC1155 to the user
IMembershipERC1155(daoMembershipAddress).mint(_msgSender(), tierIndex, 1);
emit UserJoinedDAO(_msgSender(), daoMembershipAddress, tierIndex);
}

The code calculates platformFees, which are the fees the user must pay to the protocol. However, it lacks any rounding mechanism to prevent truncation, an inherent issue in Solidity when divisions involve decimals.

To better illustrate this issue, let’s use an example with USDC, a token the protocol will handle, which has only 6 decimal of precision.

Assume tierPrice = 999 wei USDC

The calculation for platformFees would be:

platformFees = (20 * tierPrice) / 100 = (20 * 999) / 100 = 199.8 = 199

In this case, 8 wei of USDC are lost. While this may seem insignificant, when multiplied across all transactions the protocol processes, it can lead to a substantial cumulative amount.

Impact

Precision loss in the calculation of platformFees results in the protocol receiving less fees than intended.

Tools Used

Manual review.

Recommendations

One solution is to use Math.sol from OpenZeppelin to round up the result of platformFees.

Updates

Lead Judging Commences

0xbrivan2 Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.