Submission Details
Severity:
M-3 Precision loss in FeeCollector::_calculatePendingRewards
Summary
There is a potential Division Precision Loss in :
function _calculatePendingRewards(address user) internal view returns (uint256) {
uint256 userVotingPower = veRAACToken.getVotingPower(user);
if (userVotingPower == 0) return 0;
uint256 totalVotingPower = veRAACToken.getTotalVotingPower();
if (totalVotingPower == 0) return 0;
// @ audit - division loss
uint256 share = (totalDistributed * userVotingPower) / totalVotingPower;
return share > userRewards[user] ? share - userRewards[user] : 0;
}
Impact
In Solidity, integer division truncates decimals, which can cause precision loss.
This means
share = (totalDistributed * userVotingPower) / totalVotingPower;might not allocate rewards fairly in some case
Tools Used
Manual Review
Recommendations
Since at the upper part of the contract there is constant PRECISION initiated it might be a good idea to actually use it(so far its not used anywhere).
96: uint256 private constant PRECISION = 1e18;
Potential fix coud be :
uint256 share = (totalDistributed * userVotingPower * PRECISION) / totalVotingPower / PRECISION;
Updates
Lead Judging Commences
inallhonesty 3 months ago
Submission Judgement Published Assigned finding tags:
FeeCollector::_calculatePendingRewards suffers from precision loss in integer division, causing users to receive fewer rewards than they're entitled to
inallhonesty 3 months ago
Submission Judgement Published Assigned finding tags:
FeeCollector::_calculatePendingRewards suffers from precision loss in integer division, causing users to receive fewer rewards than they're entitled to
Prize pool breakdown
Total prize
77,280 USDC
nSLOC
3,86420 USDC / LOC
74,000
3,280
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.