DeFiLayer 1Layer 2
14,723 OP
View results
Submission Details
Severity: low
Invalid

Incorrect Rounding of max_change in _smoothed_price Calculation May Lead to Inaccurate Price Adjustments

Summary

Vulnerability Details

The _smoothed_price function approximates price updates using a linear model instead of an ideal exponential formula. It calculates the maximum allowable price change (max_change) using integer division:

max_change: uint256 = (
self.max_price_increment * (block.timestamp - self.last_update) * last_price // 10**18
)

This logic determines whether to adjust the price by max_change or allow the raw price. Because max_change is already rounded down, the function may reject larger updates that would have been valid if max_change were properly rounded up. This leads to delayed price adjustments, especially in fast-moving markets.

if unsafe_sub(raw_price + max_change, last_price) > 2 * max_change:
return last_price + max_change if raw_price > last_price else last_price - max_change

Impact

Since the price update mechanism already relies on a linear approximation instead of the ideal exponential formula, rounding max_change down further compounds approximation errors, potentially causing price updates to lag behind actual changes. This could result in slower price adjustments, reducing responsiveness to market movements and impacting integrations that depend on accurate pricing.

Tools Used

Manual Review

Recommendations

Ensure that the max_change is rounded up rather than down when used to calculate the price movements.

Updates

Lead Judging Commences

0xnevi Lead Judge 5 months ago
Submission Judgement Published
Invalidated
Reason: Lack of quality
Assigned finding tags:

[invalid] finding-precision-loss

All values will be scaled to a combined of 36 decimals before division (be it price-related values or totalSupply). Considering the 18 decimals of all values, no realistic values were presented in any duplicates to proof a substantial impact on precision loss.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.