code-423n4 / 2021-05-88mph-findings

0 stars 0 forks source link

Multiple definitions of PRECISION #8

Open code423n4 opened 3 years ago

code423n4 commented 3 years ago

Handle

gpersoon

Vulnerability details

Impact

There are multiple definitions of PRECISION. This risk is that is someone (a new developer?) would change the value of PRECISION on one location and might forget to change it on one of the other places.

Also 2 of them are defined public while the rest is internal.

Proof of Concept

DInterest.sol: uint256 internal constant PRECISION = 1018; libs\DecMath.sol: uint256 internal constant PRECISION = 1018; models\fee\PercentageFeeModel.sol: uint256 internal constant PRECISION = 1018; models\interest\LinearDecayInterestModel.sol: uint256 public constant PRECISION = 1018; models\interest\LinearInterestModel.sol: uint256 public constant PRECISION = 1018; models\interest-oracle\EMAOracle.sol: uint256 internal constant PRECISION = 1018; models\issuance\MPHIssuanceModel02.sol: uint256 internal constant PRECISION = 1018; rewards\Vesting02.sol: uint256 internal constant PRECISION = 1018; rewards\xMPH.sol: uint256 internal constant PRECISION = 10**18;

Tools Used

grep

Recommended Mitigation Steps

Define PRECISION once and import this in all the other contracts.