search

code-423n4 / 2022-03-paladin-findings

0 stars 0 forks source link

Precision loss #83

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Lines of code

https://github.com/code-423n4/2022-03-paladin/blob/9c26ec8556298fb1dc3cf71f471aadad3a5c74a0/contracts/HolyPaladinToken.sol#L729-L730

Vulnerability details

Impact

In line 729 of HolyPaladinToken.sol a huge precision loss occurs if dropDecreaseDuration is not a multiple of MONTH.

In its current implementation dropDecreaseDuration / MONTH will get rounded down, which means that dropDecreaseDuration of 1 month and 29 days will be treated in this function as if it was set to exactly 1 month.

Recommended mitigation steps

There are two obvious solutions to this problem, either make teh distribution changing linearly, not in jumps per month (this will just involve crossing out MONTH variable in lines 729-730) or require that the dropDecreaseDuration is a multiple of MONTH while setting it

Kogaroshi commented 2 years ago

Duplicate of https://github.com/code-423n4/2022-03-paladin-findings/issues/44 See in the linked Issue for PR with changes

0xean commented 2 years ago

upgrading per #44