Submission Details
Severity:
The way `sellerFee` is calculated inside `TokenDivider::buyOrder` leads to possible truncation.
Description
The variables fee and sellerFee are calculated using division, which may lead to truncation issues.
Impact
If truncation happens when calculating the sellerFee, the protocol will be losing money.
Proof of Concepts
A seller creates a
sellOrderwith 0 wei <price< 200 wei.A user buys the order
Both
feeandsellerFeeget truncated, resulting in a value of zero
Tools Used
Foundry, Manual analysis
Recommended mitigation
Add the following code to the contract, in order to ensure that protocol receives ceil(sellerFee) and doesn't lose any ETH:
function buyOrder(uint256 orderIndex, address seller) external payable {
if (seller == address(0)) {
revert TokenDivider__InvalidSeller();
}
SellOrder memory order = s_userToSellOrders[seller][orderIndex];
if (msg.value < order.price) {
revert TokenDivider__IncorrectEtherAmount();
}
- uint256 fee = order.price / 100;
- uint256 sellerFee = fee / 2;
+ uint256 SCALE = 1e18; // Define SCALE inside the function for precision
+ uint256 fee = (order.price * SCALE + (100 * SCALE - 1)) / (100 * SCALE);
+ uint256 sellerFee = (fee + 1) / 2; // Rounding up sellerFee
if (msg.value < order.price + sellerFee) {
revert TokenDivider__InsuficientEtherForFees();
}
balances[msg.sender][order.erc20Address] += order.amount;
s_userToSellOrders[seller][orderIndex] = s_userToSellOrders[seller][s_userToSellOrders[seller].length - 1];
s_userToSellOrders[seller].pop();
emit OrderSelled(msg.sender, order.price);
// Transfer Ether to the seller
(bool success, ) = payable(order.seller).call{value: (order.price - sellerFee)}("");
if (!success) {
revert TokenDivider__TransferFailed();
}
// Transfer the correct sellerFee to the contract owner
(bool taxSuccess, ) = payable(owner()).call{value: sellerFee}("");
if (!taxSuccess) {
revert TokenDivider__TransferFailed();
}
IERC20(order.erc20Address).transfer(msg.sender, order.amount);
}
Rewards breakdown
nSLOC
181This contest has a flat reward structure with the following payouts:
100 EXP
20 EXP
2 EXP
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.