getRequiredMargin rounding direction errors undercalculated the requiredMargin

Summary

For a specified amount of order, getRequiredMargin should be rounded up. Otherwise, due to the precision error of division, the calculated margin is insufficient.

Vulnerability Detail

    function getRequiredMargin(int256 baseAssetQuantity, uint256 price) public view returns(uint256 requiredMargin) {
        uint quoteAsset = abs(baseAssetQuantity).toUint256() * price / 1e18;
        requiredMargin = quoteAsset * minAllowableMargin / 1e6;
        requiredMargin += quoteAsset * takerFee / 1e6;
    }

            reserveAmount = getRequiredMargin(order.baseAssetQuantity, order.price);
        }

        // add orderInfo for the corresponding orderHash
        orderInfo[orderHash] = OrderInfo(block.number, 0, reserveAmount, OrderStatus.Placed);
        emit OrderPlaced(order.trader, orderHash, order, block.timestamp);

The margin should be rounded up

Impact

Round direction errors will undercalculate the requiredMargin resulting lock margin is insufficient.

Code Snippet

https://github.com/sherlock-audit/2023-04-hubble-exchange/blob/1f9a5ed0ca8f6004bbb7b099ecbb8ae796557849/hubble-protocol/contracts/orderbooks/OrderBook.sol#L425

Tool used

Manual Review

Recommendation

Round up instead of round down

sherlock-audit / 2023-04-hubble-exchange-judging

kutugu - getRequiredMargin rounding direction errors undercalculated the requiredMargin #182