Project
One World
NFTDeFi
15,000 USDC
View results
Previous Next
Submission Details
Severity: medium
Invalid

Precision Loss in Profit Distribution Calculation

pro_king

Summary

The MembershipERC1155::sendProfit function in MembershipERC1155 contract suffers from precision loss due to division rounding down, resulting in small amounts of tokens being permanently loss in the contract.

Vulnerability Details

function sendProfit(uint256 amount) external {
uint256 _totalSupply = totalSupply;
if (_totalSupply > 0) {
// Precision loss occurs here
@>>> totalProfit += (amount * ACCURACY) / _totalSupply;
IERC20(currency).safeTransferFrom(msg.sender, address(this), amount);
emit Profit(amount);
}
}

Impact

  • Small amounts lost in each distribution

  • Cumulative effect over time

  • No mechanism to recover locked tokens

  • Affects all token holders proportionally

Tools Used

Manual review

Recommendations

Tracking of undistributed for future use for protocol or again distributing to users.

function sendProfit(uint256 amount) external {
uint256 _totalSupply = totalSupply;
if (_totalSupply > 0) {
totalProfit += (amount * ACCURACY) / _totalSupply;
IERC20(currency).safeTransferFrom(msg.sender, address(this), amount);
emit Profit(amount);
} else {
IERC20(currency).safeTransferFrom(msg.sender, creator, amount); // Redirect profit to creator if no supply
}
+ undistributedAmount += amount - actualDistributed;
// assume we want to send that amount to protocol
+ IERC20(currency).safeTransferFrom( address(this), OWPWallet, undistributedAmount);
​
}
Updates

Lead Judging Commences

0xbrivan2 Lead Judge 9 months ago
Submission Judgement Published
Invalidated
Reason: Incorrect statement

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.