search

Axis-Fi / axis-core

Axis Protocol
https://axis.finance
Other
3 stars 0 forks source link

Sherlock: inconsistent price math in MaxPriorityQueue #131

Closed Oighty closed 2 months ago

Oighty commented 3 months ago

Addresses https://github.com/sherlock-audit/2024-03-axis-finance-judging/issues/83

Oighty commented 3 months ago

@0xJem can you double check me on the new tests I wrote here. I think I discovered a precision error that breaks an invariant I came up with while thinking through the price math. Namely, that a users calculated payout from a price & amount should be less than or equal to the expected payout, where the expected payout is the amountOut they bid times the price difference. I'm concerned about some payouts being slightly too big and then bricking someone who needs to claim.

I may be overthinking this because the marginal price is determined from the total bid amounts meeting the required capacity and should account for rounding, but maybe not on a per bid basis.

Oighty commented 2 months ago

Closing in preference of #146