sherlock-admin2
commented
1 year ago 1 comment(s) were left on this issue during the judging contest.
0xyPhilic commented:
invalid because supplied example is completely wrong - multiplication done is incorrect
feelereth
high
rounding errors due to performing divisions on raw token amounts in _getPendingReward().
Summary
_getPendingReward() function can introduce small rounding errors due to performing divisions on raw token amounts
Vulnerability Detail
The issue is that share and amount are raw token amounts, but the division happens after multiplying them together. For example: • share = 10000000000 (10 tokens) • amount = 100000000000 (100 tokens) • lpDecimals = 18 Multiplying first: • share * amount = 10000000000000010000000000 Then dividing by 10^18: • 10000000000000010000000000 / 1000000000000000000 = 10000010 The result should be 10 tokens but due to the multiplication first, we end up with a small rounding error. This can lead to small discrepancies in the pending rewards calculations. Over time as more dividends are accrued, the errors could compound.
Impact
Users gets slightly more or less rewards than expected. Inaccuracies in pending reward calculations could potentially be exploited by users to get more rewards than they should.
Code Snippet
https://github.com/sherlock-audit/2023-07-blueberry/blob/main/blueberry-core/contracts/wrapper/WAuraPools.sol#L187-L201
Tool used
Manual Review
Recommendation
convert share and amount to decimals before multiplying