code-423n4 / 2021-12-amun-findings

0 stars 0 forks source link

rounding error not in favor of the system #293

Open code423n4 opened 2 years ago

code423n4 commented 2 years ago

Handle

certora

Vulnerability details

division is rounded down so users pay less than they should. https://github.com/code-423n4/2021-12-amun/blob/main/contracts/basket/contracts/facets/Basket/BasketFacet.sol#L163 It's better to use mulDivRoundingUp when calculation user's debt, so the rounding error will be in favor the system. example from uniswap: https://github.com/Uniswap/v3-core/blob/main/contracts/UniswapV3Pool.sol#L800

Recommended Mitigation Steps

use mulDivRoundingUp from FullMath.sol: https://github.com/Uniswap/v3-core/blob/main/contracts/libraries/FullMath.sol