Divide Before Multiply

[code423n4]

Handle

leastwood

Vulnerability details

Impact

The function RCMarket._payoutWinnings() function is used to distribute winnings to each market participant upon calling RCMarket.withdraw(). The function uses _remainingPot as a variable to determine how much winnings to transfer to the market participant. The function performs a division on the _remainingPot variable before multiplying the result by _winnersTimeHeld to generate the _numerator variable. This may potentially lead to small rounding in the amount paid to the market participant.

Proof of Concept

https://github.com/code-423n4/2021-08-realitycards/blob/main/contracts/RCMarket.sol#L572-L586

Tools Used

slither

Recommended Mitigation Steps

Perform the division using the PER_MILLIE variable after the multiplication in uint256 _numerator = _remainingPot * _winnersTimeHeld.

[Splidge]

We acknowledge there is a rounding issue. However it appears that in the worst case this would cause _remainingPot to be just shy of 1 Wei less than it should be, this is then further divided up amongst the users that held the winning card.
Given how close we are to launch and the minimal impact this would actually have, we have decided not to make any changes to such a sensitive function.