Lines of code
<https://github.com/code-423n4/2022-08-frax/blob/92a8d7d331cc718cd64de6b02515b554672fb0f3/src/contracts/FraxlendPairCore.sol#L409-L497&gt;
<https://github.com/code-423n4/2022-08-frax/blob/92a8d7d331cc718cd64de6b02515b554672fb0f3/src/contracts/FraxlendPairCore.sol#L911-L942&gt;
<https://github.com/code-423n4/2022-08-frax/blob/92a8d7d331cc718cd64de6b02515b554672fb0f3/src/contracts/FraxlendPairCore.sol#L950-L1032&gt;
<https://github.com/code-423n4/2022-08-frax/blob/92a8d7d331cc718cd64de6b02515b554672fb0f3/src/contracts/libraries/VaultAccount.sol#L16-L29&gt;
<https://github.com/code-423n4/2022-08-frax/blob/92a8d7d331cc718cd64de6b02515b554672fb0f3/src/contracts/libraries/VaultAccount.sol#L33-L46&gt;
<https://github.com/code-423n4/2022-08-frax/blob/92a8d7d331cc718cd64de6b02515b554672fb0f3/src/contracts/LinearInterestRate.sol#L76-L92&gt;
<https://github.com/code-423n4/2022-08-frax/blob/92a8d7d331cc718cd64de6b02515b554672fb0f3/src/contracts/VariableInterestRate.sol#L63-L85&gt;

Vulnerability details

Multiplication performed after division can truncate the results

Impact

Solidity could truncate the results, performing multiplication before division will prevent rounding/truncation in solidity math.

Details

This can affect variables such as slopes, interests, fees, shares and all kinds of amounts.

##Proof of Concept
<https://github.com/code-423n4/2022-08-frax/blob/92a8d7d331cc718cd64de6b02515b554672fb0f3/src/contracts/FraxlendPairCore.sol#L409-L497&gt;
<https://github.com/code-423n4/2022-08-frax/blob/92a8d7d331cc718cd64de6b02515b554672fb0f3/src/contracts/FraxlendPairCore.sol#L911-L942&gt;
<https://github.com/code-423n4/2022-08-frax/blob/92a8d7d331cc718cd64de6b02515b554672fb0f3/src/contracts/FraxlendPairCore.sol#L950-L1032&gt;
<https://github.com/code-423n4/2022-08-frax/blob/92a8d7d331cc718cd64de6b02515b554672fb0f3/src/contracts/libraries/VaultAccount.sol#L16-L29&gt;
<https://github.com/code-423n4/2022-08-frax/blob/92a8d7d331cc718cd64de6b02515b554672fb0f3/src/contracts/libraries/VaultAccount.sol#L33-L46&gt;
<https://github.com/code-423n4/2022-08-frax/blob/92a8d7d331cc718cd64de6b02515b554672fb0f3/src/contracts/LinearInterestRate.sol#L76-L92&gt;
<https://github.com/code-423n4/2022-08-frax/blob/92a8d7d331cc718cd64de6b02515b554672fb0f3/src/contracts/VariableInterestRate.sol#L63-L85&gt;

Recommended Mitigation Steps

Reorder the operations.
For more info of the issue: <https://github.com/crytic/slither/wiki/Detector-Documentation#divide-before-multiply&gt;

The text was updated successfully, but these errors were encountered:

All reactions