sherlock-audit/2023-05-Index-judging

BugBusters - Division before multiplication in `_calculateMinRepayUnits` function causes no accurate calculation in delever

Closed this issue · 0 comments

BugBusters

high

Division before multiplication in _calculateMinRepayUnits function causes no accurate calculation in delever

Summary

_calculateMinRepayUnits function does division before multiplication to calculate minimum repay units, leading to precision loss and less accurate delevering.

Vulnerability Detail

Leveraging and deleveraging is at the heart of aave leverage extension and is the core working for the index coop for the leverage tokens so needed to do the accurate calculation.

But in the function _calculateMinRepayUnits :

    function _calculateMinRepayUnits(uint256 _collateralRebalanceUnits, uint256 _slippageTolerance, ActionInfo memory _actionInfo) internal pure returns (uint256) {
        return _collateralRebalanceUnits
            .preciseMul(_actionInfo.collateralPrice)
            .preciseDiv(_actionInfo.borrowPrice)
            .preciseMul(PreciseUnitMath.preciseUnit().sub(_slippageTolerance));
    }

Here we can see we do division before the last multiplication, hence losing the precision that directly impact the delever function.

Impact

Wrong calculation of min repayAmount leads to un precise de leveraging.

Code Snippet

https://github.com/sherlock-audit/2023-05-Index/blob/3190057afd3085143a31746d65045a0d1bacc78c/index-coop-smart-contracts/contracts/adapters/AaveLeverageStrategyExtension.sol#L1147-L1152

Tool used

Manual Review

Recommendation

Do multiplication before division

Duplicate of #299