Submission Details
Severity:
Double to precision loss while calculating the protocol Fee.
Summary
Vulnerability Details
The issue of double precision loss occurs when calculating the protocol. This could result in letting some ether dust accumulate over time in the contract. Whereas there isn't a withdrawal mechanism to get the leftover calculation dust.
The vulnerability code:
uint256 fee = order.price / 100;
uint256 sellerFee = fee / 2;
Impact
For a price of 0.8 ETH (0.8 * 1e18 wei):
fee = (0.823 * 1e18) / 100 = 0.008 * 1e18 wei
sellerFee = (0.008* 1e18) / 2 = 0.004 * 1e18 wei
Each division lose precision in wei values
Tools Used
Recommendations
To fix this:
Calculate fees using multiplication first:
// Instead of price/100
+ fee = (order.price * FEE_PERCENTAGE) / FEE_DENOMINATOR; // e.g., (price * 100) / 10000 for 1%
Add a withdrawal mechanism to clear dust for the contract.
Rewards breakdown
nSLOC
181This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.