Incorporate scaling factors

Oct 13, 2025 by pinkandtrash.com 84 views

Rural Orchid Capybara - Reward Calculation Precision Bug Due to Integer Division

Introduction

In the world of decentralized finance (DeFi), precision and accuracy are crucial in maintaining the trust and confidence of users. However, a recent discovery in the SymmStaking contract has highlighted a critical issue that can lead to inaccurate reward accrual for stakers. In this article, we will delve into the root cause of this problem, its impact on users, and potential mitigation strategies.

Summary

The use of integer division in calculating the reward rate will cause inaccurate reward accrual for stakers. This is due to the truncation of fractional tokens, resulting in a lower reward distribution over the full period.

Root Cause

The root cause of this issue lies in the SymmStaking.sol contract, specifically in the _addRewardsForToken function. The reward rate is calculated using the expression state.rate = amount / state.duration;. This expression uses integer division, which truncates any fractional remainder. For example, if the admin calls notifyRewardAmount with 1000 tokens for a 7-day period, the computed daily reward rate becomes 1000 / 7 tokens, losing any fractional remainder.

1000/7 = 142.85 
0.85 tokens are lost each day.

This loss of fractional tokens can have a significant impact on stakers, as they receive slightly less reward than intended each day.

Internal Pre-conditions

For this issue to occur, the following internal pre-conditions must be met:

The admin calls notifyRewardAmount with a reward amount (e.g., 1000 tokens) that is not a multiple of the reward duration (e.g., 7 days).
The calculation does not incorporate any scaling factor or fixed-point arithmetic to retain the fractional part of the division.

External Pre-conditions

The external pre-conditions for this issue are:

Stakers expect a precise daily reward accrual based on the announced reward amount.
The staking system relies on accurate reward computations for fair distribution among users.

Attack Path

The attack path for this issue is as follows:

The admin calls notifyRewardAmount with a reward amount of 1000 tokens for a 7-day period.
The function _addRewardsForToken computes the daily reward rate as 1000 / 7, which, due to integer division, truncates any fractional tokens.
As a result, each day stakers receive a truncated reward amount, leading to an overall lower reward distribution over the full period.

Impact

The impact of this issue is significant, as stakers receive lower than expected rewards over the duration of the reward period. This can lead to user dissatisfaction and erode trust in the staking mechanism.

PoC

Unfortunately, there is no proof of concept (PoC) available for this issue.

Mitigation

There is no mitigation strategy provided for this issue.

Conclusion

In conclusion, the use of integer division in calculating the reward rate can lead to inaccurate reward accrual for stakers. This issue is caused by the truncation of fractional tokens, resulting in a lower reward distribution over the full period. To mitigate this issue, it is essential to incorporate scaling factors or fixed-point arithmetic to retain the fractional part of the division. This will ensure that stakers receive the precise daily reward accrual they expect, maintaining the trust and confidence in the staking mechanism.

Recommendations

Based on the analysis of this issue, the following recommendations are made:

Use fixed-point arithmetic: Implement fixed-point arithmetic to retain the fractional part of the division, ensuring accurate reward computations.
Incorporate scaling factors: Incorporate scaling factors to adjust the reward rate to the nearest integer, preventing truncation of fractional tokens.
Test and validate: Thoroughly test and validate the reward calculation to ensure accuracy and precision.

By implementing these recommendations, the staking mechanism can ensure accurate and precise reward accrual for stakers, maintaining the trust and confidence in the system.
Rural Orchid Capybara - Reward Calculation Precision Bug Due to Integer Division: Q&A

Introduction

In our previous article, we discussed the issue of inaccurate reward accrual for stakers due to the use of integer division in calculating the reward rate. In this Q&A article, we will address some of the most frequently asked questions related to this issue.

Q: What is the root cause of this issue?

A: The root cause of this issue lies in the SymmStaking.sol contract, specifically in the _addRewardsForToken function. The reward rate is calculated using the expression state.rate = amount / state.duration;, which uses integer division, truncating any fractional remainder.

Q: What is the impact of this issue on stakers?

A: The impact of this issue is significant, as stakers receive lower than expected rewards over the duration of the reward period. This can lead to user dissatisfaction and erode trust in the staking mechanism.

Q: How can this issue be mitigated?

A: To mitigate this issue, it is essential to incorporate scaling factors or fixed-point arithmetic to retain the fractional part of the division. This will ensure that stakers receive the precise daily reward accrual they expect.

Q: What are some potential solutions to this issue?

A: Some potential solutions to this issue include:

Using fixed-point arithmetic: Implement fixed-point arithmetic to retain the fractional part of the division, ensuring accurate reward computations.
Incorporating scaling factors: Incorporate scaling factors to adjust the reward rate to the nearest integer, preventing truncation of fractional tokens.
Testing and validation: Thoroughly test and validate the reward calculation to ensure accuracy and precision.

Q: Why is this issue important?

A: This issue is important because it can lead to user dissatisfaction and erode trust in the staking mechanism. Accurate and precise reward accrual is essential for maintaining the trust and confidence of users in the staking system.

Q: Can this issue be prevented in the future?

A: Yes, this issue can be prevented in the future by incorporating scaling factors or fixed-point arithmetic to retain the fractional part of the division. This will ensure that stakers receive the precise daily reward accrual they expect.

Q: What is the current status of this issue?

A: Unfortunately, there is no proof of concept (PoC) available for this issue. However, we are working to provide a mitigation strategy and potential solutions to this issue.

Q: How can users protect themselves from this issue?

A: Users can protect themselves from this issue by:

Monitoring their rewards: Regularly monitor their rewards to ensure they are receiving the expected amount.
Reporting issues: Report any issues or discrepancies in their rewards to the staking team.
Staying informed: Stay informed about any updates or changes to the staking mechanism.

Conclusion

In conclusion, the issue of inaccurate reward accrual for stakers due to the use of integer division in calculating the reward rate is a significant concern. By incorporating scaling factors or fixed-point arithmetic to retain the fractional part of the division, we can ensure that stakers receive the precise daily reward accrual they expect. We hope this Q&A article has provided valuable information and insights into this issue.