Misleading variable names

[code423n4]

Handle

WatchPug

Vulnerability details

https://github.com/code-423n4/2021-11-malt/blob/c3a204a2c0f7c653c6c2dda9f4563fd1dc1cecf3/src/contracts/Auction.sol#L1000-L1006

function setAuctionEndReserveBps(uint256 _bps)
    external
    onlyRole(ADMIN_ROLE, "Must have admin privilege")
  {
    require(_bps > 0 && _bps < 1000, "Must be between 0-100%");
    auctionEndReserveBps = _bps;
  }

Basis points (BPS) refers to a common unit of measure for interest rates and other percentages in finance. One basis point is equal to 1/100th of 1%, or 0.01%, or 0.0001.

auctionEndReserveBps is actually using 1 to represent 1/1000th while with bps in the name.

[GalloDaSballo]

Absolutely agree with finding, would highly recommend the sponsor to implement this fix to avoid potential further confusion