buyQuote rounds the answer down which can be abused for a profit

[code423n4]

Lines of code

https://github.com/code-423n4/2022-12-caviar/blob/0212f9dc3b6a418803dbfacda0e340e059b8aae2/src/Pair.sol#L399

Vulnerability details

Impact

The buyQuote function calculates the "amount of base tokens required to buy a given amount of fractional tokens". This value is rounded down, which differs from the similar function in UniswapV2. Since the value is rounded down instead of up, the user will pay less than they need to, which can be abused to make a profit.

Proof of Concept

• Suppose baseTokens are valuable per wei, e.g. WBTC.
• The buyQuote calculations would have a relatively small amount of outputAmount token round down to zero, so that the user pays nothing to get a non-zero amount of output, which would be worth a non-trivial amount of money in the case of WBTC.
• The user can repeat multiple times and essentially extract free money from the protocol.

Tools Used

Manual.

Recommended Mitigation Steps

Add one to the final answer in buyQuote, similar to how getAmountIn works in UniswapV2.

[c4-judge]

berndartmueller marked the issue as duplicate of #243

[c4-judge]

berndartmueller changed the severity to 2 (Med Risk)

[c4-judge]

berndartmueller marked the issue as satisfactory