PRAISE - possible precision loss in D3VaultLiquidation.finishLiquidation() function when calculating realDebt because of division before multiplication

[sherlock-admin]

PRAISE

medium

possible precision loss in D3VaultLiquidation.finishLiquidation() function when calculating realDebt because of division before multiplication

Summary

finishLiquidation() divides before multiplying when calculating realDebt.

Vulnerability Detail

uint256 realDebt = borrows.div(record.interestIndex == 0 ? 1e18 : record.interestIndex).mul(info.borrowIndex);

There will be precision loss when calculating the realDebt because solidity truncates values when dividing and dividing before multiplying causes precision loss.

Values that suffered from precision loss will be updated here

 info.totalBorrows = info.totalBorrows - realDebt;

Impact

Values that suffered from precision loss will be updated here

 info.totalBorrows = info.totalBorrows - realDebt;

Code Snippet

https://github.com/sherlock-audit/2023-06-dodo/blob/main/new-dodo-v3/contracts/DODOV3MM/D3Vault/D3VaultLiquidation.sol#L144

https://github.com/sherlock-audit/2023-06-dodo/blob/main/new-dodo-v3/contracts/DODOV3MM/D3Vault/D3VaultLiquidation.sol#L147

Tool used

Manual Review

Recommendation

don't divide before multiplying

[traceurl]

fixed in https://github.com/DODOEX/new-dodo-v3/pull/31

[IAm0x52]

Doesn't address this issue. Though precision loss is very minimal given the decimal math utilized. Optional change here

[Attens1423]

There is another fix for this issue. We realised the last one does not work: https://github.com/DODOEX/new-dodo-v3/pull/54/files

[IAm0x52]

Fix looks good. Creates the _borrowAmount function which fixes the order of operations