Wong calculation of buyQuote

[code423n4]

Lines of code

https://github.com/code-423n4/2022-12-caviar/blob/0212f9dc3b6a418803dbfacda0e340e059b8aae2/src/Pair.sol#L398-L400

Vulnerability details

Impact

Detailed description of the impact of this finding.
The calculation of buyQuote seems to not quite right, we need to add 1 add the end to avoid edge case such as zero. See the standard implementation at Uniswap V2:
https://github.com/Uniswap/v2-periphery/blob/0335e8f7e1bd1e8d8329fd300aea2ef2f36dd19f/contracts/libraries/UniswapV2Library.sol#L58

 function buyQuote(uint256 outputAmount) public view returns (uint256) {
        return (outputAmount * 1000 * baseTokenReserves()) / ((fractionalTokenReserves() - outputAmount) * 997) + 1;
    }

Proof of Concept

Provide direct links to all referenced code in GitHub. Add screenshots, logs, or any other relevant proof that illustrates the concept.
https://github.com/code-423n4/2022-12-caviar/blob/0212f9dc3b6a418803dbfacda0e340e059b8aae2/src/Pair.sol#L398-L400

Tools Used

Remix

Recommended Mitigation Steps

[Shungy]

Dup #436

[c4-judge]

berndartmueller marked the issue as duplicate of #243

[berndartmueller]

Due to the low quality of the submission (impact not clearly stated, missing recommended mitigation step, poor PoC), I'm applying a partial credit of 50%.

[c4-judge]

berndartmueller marked the issue as partial-50

[c4-judge]

berndartmueller changed the severity to 2 (Med Risk)