094.md

Jovial Teal Butterfly

High

Precision loss in calculation of redeemRate in Pool.sol::getRedeemAmount function.

Summary

In getRedeemAmount function the redeemRate at one instance is calculated as - https://github.com/sherlock-audit/2024-12-plaza-finance/blob/14a962c52a8f4731bbe4655a2f6d0d85e144c7c2/plaza-evm/src/Pool.sol#L514 redeemRate = ((tvl - (bondSupply * BOND_TARGET_PRICE)) / assetSupply) * PRECISION;

It's clearly divison before multiplication. which is classic case of precision error.

1. If numerator is less than denominator, then the result will be always zero.
2. and if redeemRate 0, due to above calculation the redeemAMount is also 0. due to following calculation.

return ((depositAmount * redeemRate).fromBaseUnit(oracleDecimals) / ethPrice) / PRECISION;

Root Cause

Divison before multiplication

Impact

Incorrect calculation of redeemRate and redeemAmount, hence user will not able to get correct amount of wstETH, that's intended.

Mitigation

Using this instead - redeemRate = ((tvl - (bondSupply * BOND_TARGET_PRICE)) * PRECISION) / assetSupply;