bigbick123456789000 - Incorrect `TELCOIN` Distribution Calculation in `_retrieve` Function

[sherlock-admin2]

bigbick123456789000

medium

Incorrect TELCOIN Distribution Calculation in _retrieve Function

Summary

The _retrieve function in the CouncilMember contract contains an issue related to the calculation of TELCOIN distribution. The problem lies in the calculation of the individualBalance, where the runningBalance is not properly adjusted, potentially leading to inaccurate distribution among council members.

Vulnerability Detail

The vulnerable code snippet is as follows:

uint256 finalBalance = (currentBalance - initialBalance) + runningBalance;
uint256 individualBalance = finalBalance / totalSupply();
runningBalance = finalBalance % totalSupply();

The issue arises in the calculation of individualBalance, where it is computed based on finalBalance, which already includes the runningBalance. Consequently, the subsequent update of runningBalance does not account for the runningBalance itself, leading to potential inaccuracies in TELCOIN distribution.

The purpose of the _retrieve function is to fetch the maximum possible TELCOIN and distribute it equally among all council members, updating the running balance to ensure accurate distribution during subsequent calls.

Impact

The impact of this issue is that the TELCOIN distribution among council members may not be accurate. Council members could receive more or fewer tokens than intended, affecting the fairness of the distribution mechanism.

Code Snippet

Link

Tool used

Manual Review

Recommendation

Calculation of runningBalance should be adjusted to correctly represent the remainder after distributing TELCOIN equally among all council members.

uint256 finalBalance = (currentBalance - initialBalance) + runningBalance;
uint256 individualBalance = finalBalance / totalSupply();
runningBalance -= runningBalance % totalSupply();

Duplicate of #161

[sherlock-admin2]

1 comment(s) were left on this issue during the judging contest.

takarez commented:

invalid because { The watson failed to explain what to do with the remainder after takig account of it and the report is poorly written}