Submission Details
Severity:
[M-1] Precision Loss in USD Token Minting Creates Protocol Debt in CreditDelegationBranch
Summary
withdrawUsdTokenFromMarket truncates fractional values during adjustedUsdTokenToMintX18 → uint256 conversion, creating unredeemable USD Token.
Vulnerability Details
Affected Code:
UD60x18 adjustedUsdTokenToMintX18 = ...;
amountToMint = adjustedUsdTokenToMintX18.intoUint256(); // Truncates decimals
Example:
Calculated mint amount: 100.999999 USD
Actual minted: 100 USD
0.999999 USD becomes protocol debt
Exploit Scenario:
Repeated small truncations across markets create systemic unbacked debt.
Impact
Exploit Scenario:
Repeated small truncations across markets create systemic unbacked debt.
Tools Used
PRBMath analysis
Differential testing
Recommendations
// Round up to prevent protocol debt
amountToMint = adjustedUsdTokenToMintX18.ceil().intoUint256();
Prize pool breakdown
Total prize
70,000 USDC
nSLOC
3,25821 USDC / LOC
66,500
3,500
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.