Liquidity Management
Gamma
DeFiFoundry
50,000 USDC
View results
Previous Next
Submission Details
Severity: low
Invalid

Precision Loss in _mint Function Leading to Silent Asset Drain

olami9783

Summary

The mint() function suffers from precision loss due to solidity integer truncation when calculating shares. This results in users receiving fewer shares than they should, effectively losing a portion of their deposit value. The lost shares remain trapped in the contract, creating an unfair advantage for larger liquidity providers and enabling potential exploits.

Vulnerability details

totalShares = 10,000,000

totalAmountBefore = 10,000,000 USDC

amount(new deposit) 97 USDC

_shares = (97.9 * 10,000,000) / 10,000,000;
= 979,000,000 / 10,000,000;
= 97.9 (but Solidity rounds down to 97).

  • User should receive 97.9 shares, but only gets 97.

  • 0.9 shares worth of USDC is lost. which is approximately $1

Impact

  • Users lose a fraction of their deposit due to rounding errors, leading to economic loss.

  • Repeated deposits accumulate losses, draining value from smaller depositors.

  • The lost shares stay in the contract, silently benefiting large liquidity providers.

  • If exploited, an attacker could strategically deposit specific amounts to drain other's value.

Tools Used

Manual Review

Recommendations

To prevent this loss, we scale all calculations by 1e18 before performing division:

_shares = (amount * totalShares * 1e18) / (totalAmountBefore * 1e18);
Updates

Lead Judging Commences

n0kto Lead Judge 8 months ago
Submission Judgement Published
Invalidated
Reason: Non-acceptable severity
Assigned finding tags:

Informational or Gas

Please read the CodeHawks documentation to know which submissions are valid. If you disagree, provide a coded PoC and explain the real likelihood and the detailed impact on the mainnet without any supposition (if, it could, etc) to prove your point.

Suppositions

There is no real proof, concrete root cause, specific impact, or enough details in those submissions. Examples include: "It could happen" without specifying when, "If this impossible case happens," "Unexpected behavior," etc. Make a Proof of Concept (PoC) using external functions and realistic parameters. Do not test only the internal function where you think you found something.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.