088.md

Formal Pecan Mongoose

Medium

incorrect slippage calculation

Summary

Incorrect slippage calculation leading to errors

Root Cause

https://github.com/sherlock-audit/2024-12-numa-audit/blob/main/Numa/contracts/lending/NumaLeverageVaultSwap.sol#L17C5-L41C6

The slippage variable is set to 10000, with the comment // 1e4/1e18, suggesting it's intended to represent a percentage or a fraction.

In the getAmountIn function, slippage is calculated as: amountIn = amountIn + (amountIn * slippage) / 1 ether;

However, dividing by 1 ether (which is 1e18) with slippage = 10000 results in a negligible addition due to integer division truncation. Essentially, (amountIn * 10000) / 1e18 rounds down to zero for practical values of amountIn.

Internal pre-conditions

No response

External pre-conditions

No response

Attack Path

Let's assume amountIn = 1e18 (representing 1 token with 18 decimals).

Calculating the slippage addition: (1e18 * 10000) / 1e18 = 10000 The slippage added is 10000, which is negligible compared to 1e18.

If slippage is intended to be a percentage, say 1%, the calculation should yield 1e16 (which is 1% of 1e18), not 10000

Impact

The slippage addition is effectively zero, so the function does not account for slippage in some cases.

PoC

No response

Mitigation

If slippage is intended to represent basis points (where 1 basis point = 0.01%), you should set slippage in terms of basis points and adjust the calculation: uint256 slippage = 100; // Represents 1% slippage in basis points amountIn = amountIn + (amountIn * slippage) / 10000;

OR uint256 slippage = 100; // Represents 1% slippage in basis points

// In getAmountIn function: amountIn = amountIn + (amountIn * slippage) / 10000;