Root + Impact

Description

• The health factor calculation inside DSCEngine.vy performs arithmetic operations in an incorrect precision order, causing integer truncation to inflate the computed health factor.

• Due to integer truncation, the computed health factor may be artificially inflated.

• This allows users to mint DSC beyond safe collateral limits, creating undercollateralized positions without triggering _revert_if_health_factor_is_broken().

• This directly threatens protocol solvency.

  
  

  The protocol enforces safety using:

If division is performed before multiplication / precision scaling (or oracle decimals are misaligned), integer truncation occurs and lost precision cannot be recovered.

A vulnerable ordering looks like:

Conceptually, health factor should be:

However, if implemented as:

then integer division truncates precision early, inflating the final result and allowing unsafe minting.

Risk

Likelihood: High

• Reason 1 Precision bugs in fixed-point math are common in DeFi protocols.

• Reason 2 Integer truncation is deterministic and exploitable at boundary conditions.

• Reason 3 Users can intentionally mint just above the safe threshold to trigger rounding advantage.

Impact: High

• Impact 1 Users can mint more DSC than liquidation threshold allows.

• Impact 2 Positions become undercollateralized immediately after mint.

• Impact 3 Protocol accumulates bad debt during volatility.

Severity: High

This issue directly breaks the solvency invariant of the protocol.

Proof of Concept

Steps to Reproduce

1. Deposit collateral worth $100.

2. With a 50% liquidation threshold, the maximum safe mint is $50.

3. Attempt to mint $51 DSC.

4. The transaction should revert because the resulting health factor becomes < 1e18.

5. Due to incorrect precision/order, the mint succeeds and the account becomes undercollateralized.

Test case

Expected Result

Transaction reverts with DSCEngine__BreaksHealthFactor.

Actual Result

Transaction succeeds and health_factor < 1e18, proving undercollateralized minting is allowed.

Root Cause

The health factor computation performs division before full multiplication and precision normalization.

Integer division truncates fractional precision, inflating the computed health factor and allowing unsafe minting to pass _revert_if_health_factor_is_broken().

Recommended Mitigation

Fix by preserving precision until the final division (multiply before divide), and normalize oracle decimals so all internal values are consistent.

Explanation

1. Fix math ordering (multiply before divide)

Compute the adjusted collateral first, then divide at the end:

This preserves precision until the final division and prevents rounding from inflating health factor.

2. Normalize oracle decimals explicitly (if feeds are 8 decimals)

Ensuring all internal math uses consistent 1e18 precision prevents mis-scaling errors.

Conclusion

Incorrect precision handling and math ordering in the health factor computation enables users to mint DSC beyond safe collateral limits.

This leads to undercollateralized debt and threatens protocol solvency.

Because this affects the core invariant of the stablecoin system, this issue is High severity.