search

code-423n4 / 2022-05-factorydao-findings

1 stars 1 forks source link

Precision loss of coinsPerSecond #194

Closed code423n4 closed 2 years ago

code423n4 commented 2 years ago

Lines of code

https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/MerkleVesting.sol#L117-L118

Vulnerability details

Impact

coinsPerSecond is totalCoins(in token's decimals) divided by the length of vesting period in seconds. For low decimal token such as USDC, coinsPerSecond might have significant precision loss that will make user received less than the amount entitled.

Proof of Concept

https://github.com/code-423n4/2022-05-factorydao/blob/db415804c06143d8af6880bc4cda7222e5463c0e/contracts/MerkleVesting.sol#L117-L118

        uint coinsPerSecond = totalCoins / (endTime - startTime);

For example if 0.01 WBTC is vested over 1 year coinsPerSecond = 0.01 10e8 / (36586400) = 0 which the user will not be able to claim any of the balance

Recommended Mitigation Steps

Multiply coinsPerSecond by for example 10e18

illuzen commented 2 years ago

Duplicate #107