prevent rounding error

[code423n4]

Handle

gpersoon

Vulnerability details

Impact

On several locations in the code a multiplication by 106 and then a division by 106 is used to prevent rounding errors, see examples below.

However in a similar situation in updateStreamInternal(), when calculating ts.tokens, this construction is not used. This might lead to some (probably minor) rounding errors.

Proof of Concept

https://github.com/code-423n4/2021-11-streaming/blob/56d81204a00fc949d29ddd277169690318b36821/Streaming/src/Locke.sol#L203-L250

function updateStreamInternal(address who) internal {
      ...
                ts.tokens -= uint112(acctTimeDelta * ts.tokens / (endStream - ts.lastUpdate));
        ...
                uint256 globalStreamingSpeedPerSecond = (uint256(unstreamed) * 10**6)/ (endStream - lastUpdate);
                unstreamed -= uint112((uint256(tdelta) * globalStreamingSpeedPerSecond) / 10**6);

https://github.com/code-423n4/2021-11-streaming/blob/56d81204a00fc949d29ddd277169690318b36821/Streaming/src/Locke.sol#L355-L363

 function dilutedBalance(uint112 amount) internal view returns (uint256) {
...
         uint32 timeRemaining = endStream - uint32(block.timestamp);
         return ((uint256(streamDuration) * amount * 10**6) / timeRemaining) / 10**6;
 

Tools Used

Recommended Mitigation Steps

Change the code to

 ts.tokens -= uint112(acctTimeDelta * ts.tokens * 10**6 / (endStream - ts.lastUpdate) / 10**6 );