Division before Multiplication could incur unnecessary precision loss

Lines of code Vulnerability details Impact Division before multiplication could incur unnecessary precision loss causing loss of funds. Proof of Concept In the dynamicQuorumVotes function of NounsDAOV3DynamicQuorum.sol contract the value of againstVotesBPS is first calculated by dividing a value ...

Division before multiplication truncate minOut and incurs heavy precision loss and result in insufficient slippage protection

Lines of code Vulnerability details Impact When Calcuting the minOut before doing trade, Division before multiplication truncate minOut and incurs heavy precision loss, then very sub-optimal amount of the trade output can result in loss of fund from user because of the insufficient slippage...

Upgraded Q -> 2 from #29 [1679672352018]

Judge has assessed an item in Issue 29 as 2 risk. The relevant finding follows: M-02 Division before multiplication incurs unnecessary precision loss 29 --- The text was updated successfully, but these errors were encountered: All reactions...

Division before multiply results in precision loss

Lines of code Vulnerability details Impact Precision loss occurs when division is carried out before multiplication, that can affect gas calculation in terms of publishing the data to L1. Proof of Concept Tools Used Manual Review Recommended Mitigation Steps Recommendation is made for avoiding...

Malicious users can claim BYTES rewards after withdrawing all of their LP stake

Lines of code Vulnerability details Impact Users are able to continue claiming BYTES rewards indefinitely on their initials points after withdrawing all of their LP stake. Proof of Concept A user can withdraw all of their LP staked tokens in multiple steps with an amount 1e16. If the amount is...

Attacker can abuse rounding down to get reward without depositing anything in LP pool

Lines of code Vulnerability details Impact In function withdrawLP, it calculates the amount of points from the amount input parameter. unchecked uint256 points = amount 100 / 1e18 lpPosition.multiplier / DIVISOR; // Update the caller's LP token stake. lpPosition.amount -= amount; lpPosition.point...

Unnecessary precision loss in redeemKIBT()

Lines of code Vulnerability details Impact Unnecessary precision loss in redeemKIBT Proof of Concept If enter Deprecated mode, user can switch back to StableCoin by percentage with redeemKIBT The redeemKIBT implementation code is as follows: function redeemKIBTuint256 amount external override...

First depositor can break minting of shares

Lines of code Vulnerability details Vulnerability details The calculation of exchange rate for shares in Popcorn Vault is done by dividing the total supply of shares by the totalAssets of the vault. The first depositor can mint a very small number of shares, then donate to the vault to manipulate...

DIVISION BEFORE MULTIPLICATION ERROR IN CALCULATING INTEREST CAN LEAD TO LARGER PRECISION LOSS

Lines of code Vulnerability details Impact There is a division before multiplication bug in accrueInterest method of Lendgine.sol which may result in loss of interest being accrued due to huge precision loss. There is same error in invariant method of Pair.sol as well which can cause larger...

Precision loss in the invariant function can lead to loss of funds

Lines of code Vulnerability details Impact An attacker can steal the funds without affecting the invariant. Proof of Concept We can say the function Pair.invariant is the heart of the protocol. All the malicious trades should be prevented by this function. Pair.sol 52: /// @inheritdoc IPair 53:...

TokenggAVAX.sol : First depositor can break minting of shares

Lines of code Vulnerability details Impact A well known attack vector for almost all shares based liquidity pool contracts, where an early user can manipulate the price per share and profit from late users' deposits because of the precision loss caused by the rather large value of price per share...

The vulnerability of the sec_store component in the Android operating system of Samsung devices with Qualcomm chipsets allows a hacker to compromise the confidentiality, integrity, and accessibility of the protected information.

The vulnerability of the secstore component in the Android operating system on Samsung devices with Qualcomm chipsets SDM660, MSM8998, SDM845, SM8150 arises from the loss of precision for a large number of operations. Exploiting this vulnerability allows an attacker to compromise the...

Truncate of values can be avoided

Lines of code Vulnerability details Truncate of values can be avoided Summary Solidity integer division might truncate. As a result, performing multiplication before division can sometimes avoid loss of precision. Details In general, this is a problem due to precision. In this case, it also affec...

First depositer can break Vault share distributions

Lines of code Vulnerability details The calculation of exchange rate for shares in PirexERC4626 Vault is done by dividing the total supply of shares by the totalAssets of the vault. The first depositor can mint a very small number of shares, then donate to the vault to manipulate the share price...

Loss of precision will lock portions of tokens

Lines of code Vulnerability details Impact When the initial balance of a redemption reward token is smaller than the base, small amounts of the token will be rounded down to zero, meaning small-amount users will get nothing for redeeming tokens. Broken accounting means high severity Proof of...

Divide before multiply

Lines of code Vulnerability details Divide before multiply Impact Solidity integer division might truncate. As a result, performing multiplication before division can sometimes avoid loss of precision. Details In general, this is a problem due to precision. In this case, it also affects...

Division Before Multiplication Can Lead To Precision Loss

Lines of code Vulnerability details Impact There is a division before multiplication bug that exists in getPriceLP. When this occurs the returned TWAP pricing of the LP tokens from pairs will be off. Proof of Concept Consider the following example: a = 100 b = 30 c = 13 function mathuint256 a,...

Moving average precision is lost

Lines of code Vulnerability details Now the precision is lost in moving average calculations as the difference is calculated separately and added each time, while it typically can be small enough to lose precision in the division involved. For example, 10000 moves of 990 size, numObservations =...

Losing precision of toShares and toAmount in VaultAccount.sol when doing accounting calculation.

Lines of code Vulnerability details Impact Detailed description of the impact of this finding. the code in VaultAccountingLibrary: function toShares VaultAccount memory total, uint256 amount, bool roundUp internal pure returns uint256 shares if total.amount == 0 shares = amount; else shares =...

buyoutPrice precision is lost in Buyout's start and Migration's commit

Lines of code Vulnerability details Buyout's start now determine the price for buyout with the truncation to 1% of supply. When buyout initiator brings in the big enough amount of fractional tokens current formula can yield substantial mispricing of initiator's fractional tokens value, which will...