[trail of bits audit] #1 Loss of precision may allow an attacker to get funds for free

This commit is contained in:
mingda
2020-09-25 10:51:03 +08:00
parent b4b75bcb71
commit f0cffd840d
3 changed files with 8 additions and 1 deletions

View File

@@ -14,6 +14,7 @@ import {DODOMath} from "../lib/DODOMath.sol";
import {Types} from "../lib/Types.sol"; import {Types} from "../lib/Types.sol";
import {Storage} from "./Storage.sol"; import {Storage} from "./Storage.sol";
/** /**
* @title Pricing * @title Pricing
* @author DODO Breeder * @author DODO Breeder
@@ -84,7 +85,7 @@ contract Pricing is Storage {
uint256 Q2 = DODOMath._SolveQuadraticFunctionForTrade( uint256 Q2 = DODOMath._SolveQuadraticFunctionForTrade(
targetQuoteAmount, targetQuoteAmount,
quoteBalance, quoteBalance,
DecimalMath.mul(i, amount), DecimalMath.mulCeil(i, amount),
true, true,
_K_ _K_
); );

View File

@@ -10,6 +10,7 @@ pragma experimental ABIEncoderV2;
import {SafeMath} from "./SafeMath.sol"; import {SafeMath} from "./SafeMath.sol";
/** /**
* @title DecimalMath * @title DecimalMath
* @author DODO Breeder * @author DODO Breeder
@@ -25,6 +26,10 @@ library DecimalMath {
return target.mul(d) / ONE; return target.mul(d) / ONE;
} }
function mulCeil(uint256 target, uint256 d) internal pure returns (uint256) {
return target.mul(d).divCeil(ONE);
}
function divFloor(uint256 target, uint256 d) internal pure returns (uint256) { function divFloor(uint256 target, uint256 d) internal pure returns (uint256) {
return target.mul(ONE).div(d); return target.mul(ONE).div(d);
} }

View File

@@ -8,6 +8,7 @@
pragma solidity 0.6.9; pragma solidity 0.6.9;
pragma experimental ABIEncoderV2; pragma experimental ABIEncoderV2;
/** /**
* @title SafeMath * @title SafeMath
* @author DODO Breeder * @author DODO Breeder