Precision loss in verifyStablesLimit function may cause incorrect validation for collateral amounts

[c4-bot-6]

Lines of code

https://github.com/code-423n4/2024-11-ethena-labs/blob/main/contracts/ustb/UStbMinting.sol#L544-L575

Vulnerability details

Impact

When collateralDecimals > ustbDecimals, the calculation normalizedCollateralAmount = collateralAmount / scale introduces potential precision loss. This may cause the condition differenceInBps <= stablesDeltaLimit to evaluate as true inappropriately when normalizedCollateralAmount <= ustbAmount during redemption. This could lead to inaccurate validations, potentially allowing redemption amounts outside the intended bounds.

Proof of Concept

function test_verify_stables_limit() external {
    vm.prank(benefactor);
    USDTToken.mint(25000 * 10 ** 18);

    uint128 stablesDeltaLimit = 100; // 100 bps

    vm.prank(owner);
    UStbMintingContract.setStablesDeltaLimit(stablesDeltaLimit);

    uint128 ustbAmount = 1000 * 10 ** 6; // 1,000 UStb

    uint128 usdtAmountAtUpperLimit = 1010 * 10 ** 18; // 100 bps above the USDT amount that should be at the upper bps limit
    uint128 usdtAmountAtUpperLimitLg = 1999 * 10 ** 18; // larger than 100 bps above the USDT amount
    uint128 usdtAmountAtLowerLimit = 990 * 10 ** 18; // 100 bps below the USDT amount that should be at the lower bps limit

    address usdtAddress = address(USDTToken);

    assertEq(
        UStbMintingContract.verifyStablesLimit(
            usdtAmountAtUpperLimit,
            ustbAmount,
            usdtAddress,
            IUStbMinting.OrderType.MINT
        ),
        true
    );

    assertEq(
        UStbMintingContract.verifyStablesLimit(
            usdtAmountAtUpperLimitLg,
            ustbAmount,
            usdtAddress,
            IUStbMinting.OrderType.MINT
        ),
        false
    );

    assertEq(
        UStbMintingContract.verifyStablesLimit(
            usdtAmountAtLowerLimit,
            ustbAmount,
            usdtAddress,
            IUStbMinting.OrderType.REDEEM
        ),
        true
    );
}

Explanation

In the above test case, when validating usdtAmountAtLowerLimit, the function returns true even if the normalized value during redemption should have been checked more accurately. This confirms that precision loss can impact validation results.

Recommended Mitigation Steps

Introduce rounding mechanisms or adjust precision handling to avoid precision loss during the division operation:

• Implement SafeMath-like rounding functions.
• Consider using higher precision types if needed (e.g., uint256) or introducing safeguards to handle scaling differences more accurately.

[c4-judge]

0xEVom marked the issue as satisfactory

[c4-judge]

0xEVom marked the issue as unsatisfactory:
Invalid

[c4-judge]

0xEVom changed the severity to QA (Quality Assurance)

[c4-judge]

This previously downgraded issue has been upgraded by 0xEVom

[c4-judge]

This previously downgraded issue has been upgraded by 0xEVom

[c4-judge]

0xEVom removed the grade

[c4-judge]

0xEVom changed the severity to QA (Quality Assurance)