Part 2
Zaros
PerpetualsDEXFoundrySolidity
70,000 USDC
View results
Previous Next
Submission Details
Severity: high
Invalid

Audit Report for VaultRouterbranch.sol contract - High severity issue

0xjonaseb11

Summary
external/
└── market-making/
└── branches/
└── VaultRouterBranch.sol

Vulnerability details


Precision Loss in Arithmetic Operations

Description:

Fixed-point arithmetic operations (UD60x18, SD59x18) may lead to precision loss, especially in getIndexTokenSwapRate and getVaultAssetSwapRate, potentially affecting financial calculations.

Code Affected:

getIndexTokenSwapRate, getVaultAssetSwapRate.

// get decimal offset
uint8 decimalOffset = Constants.SYSTEM_DECIMALS - IERC20Metadata(vault.indexToken).decimals();
​
// Get the asset amount out for the input amount of shares, taking into account the vault's debt
// See {IERC4626-previewRedeem}
// `IERC4626(vault.indexToken).totalSupply() + 10 ** decimalOffset` could lead to problems
uint256 previewAssetsOut = sharesIn.mulDiv(
totalAssetsMinusVaultDebt,
IERC4626(vault.indexToken).totalSupply() + 10 ** decimalOffset,
MathOpenZeppelin.Rounding.Floor
);
​
uint8 decimalOffset = Constants.SYSTEM_DECIMALS - IERC20Metadata(vault.indexToken).decimals();
​
// Get the shares amount out for the input amount of tokens, taking into account the unsettled debt
// See {IERC4626-previewDeposit}.
// `IERC4626(vault.indexToken).totalSupply() + 10 ** decimalOffset` could lead to problems
uint256 previewSharesOut = assetsIn.mulDiv(
IERC4626(vault.indexToken).totalSupply() + 10 ** decimalOffset,
totalAssetsMinusVaultDebt,
MathOpenZeppelin.Rounding.Floor
);
​

Impact

  • Inaccurate calculations leading to incorrect asset valuation.

  • Financial discrepancies affecting user transactions.

Tools Used

  • Manual Code Review: Analyzed floating-point calculations.

  • Remix: Debugged precision issues in arithmetic operations.

Recommendations

  1. Implement rounding adjustments to minimize precision loss.

  2. Utilize higher-precision mathematical libraries where necessary.

  3. Conduct extensive testing to compare expected vs. actual results.

Updates

Lead Judging Commences

inallhonesty Lead Judge 10 months ago
Submission Judgement Published
Invalidated
Reason: Lack of quality

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.

Give us feedback!