06-rounding

Challenge 6: Rounding

This sixth challenge will depict a common bug that could have critical consequences, this challenge is about...

Wait ❗ Don't you want to try solving it first? 😎

Try finding the security vulnerability in the contract in ./src.

If you are stuck or want to skip to the explanation of the vulnerability of this challenge, please check the explanation page or our blog post CosmWasm Security Spotlight #4.

Running the tests

To run the functional tests included with this CosmWasm smart contract:

cargo test --tests -- unittests

Running the proof of concept that shows the exploit

To run the proof of concept:

cargo test --tests -- exploit

Audit findings

Reading and understanding real audit findings is a great way to ensure that you got a grasp of the current security topic. Please check the below list of Oak Security's audit reports 🔍 where this same bug was discovered in a real-world audit:

• Report 1, finding #4 "Possible inconsistencies when configuring decimal values."
• Report 2, finding #1 "Attackers can cause a consensus failure by sending coins through IBC"
• Report 3, finding #3 "Multiple rounding issues may cause zero rewards to be distributed"