Skip to content

Latest commit

 

History

History
50 lines (30 loc) · 1.82 KB

051.md

File metadata and controls

50 lines (30 loc) · 1.82 KB

Dazzling Sapphire Newt

Medium

Missing Check for Non-Zero Liquidity Parameter in LMSR.sol

Summary

The missing check in LMSR.sol for b != 0 will cause an unexpected revert for users as they attempt to call functions like getOdds or getCost when liquidityParameter is 0, because PRBMath (or raw division) will revert without a clear message.

Root Cause

In https://github.com/sherlock-audit/2024-12-ethos-update/blob/main/ethos/packages/contracts/contracts/utils/LMSR.sol#L169-L173

/main/ethos/packages/contracts/contracts/utils/LMSR.sol#L169-L173

UD60x18 b = convert(liquidityParameter);
UD60x18 yesRatio = yesUD.div(b);
UD60x18 noRatio = noUD.div(b);

the choice to rely on PRBMath’s division to revert is a mistake as it does not provide an explicit check or custom error when liquidityParameter == 0. This can lead to unexpected behavior or less informative error messages.

Internal Pre-conditions

No response

External Pre-conditions

No response

Attack Path

  • The related role sets liquidityParameter = 0.
  • A user calls a function in the main contract that invokes LMSR.getOdds(...) or LMSR.getCost(...).
  • The code inside LMSR does UD60x18.div(...) or exp(...) with b = 0.
  • PRBMath reverts internally due to division by zero, giving a generic revert message instead of a clear, custom error.

Impact

The affected party (end users) cannot execute trades or view correct odds in the LMSR-based market if liquidityParameter is zero.

PoC

No response

Mitigation

Add an explicit check for b != 0 (i.e., liquidityParameter != 0) at the very start of each relevant function or in a shared internal function. Revert with a custom error (e.g., InvalidLiquidityParameter()) to give a clear and immediate explanation if the caller or an admin inadvertently sets liquidityParameter to zero.