Wenwin contest - minhtrng's results

Lines of code

https://github.com/code-423n4/2023-03-wenwin/blob/91b89482aaedf8b8feb73c771d11c257eed997e8/src/LotteryMath.sol#L52-L53

Vulnerability details

Impact

When calculating new profit, the calculation for non-jackpot rewards are not normalized and will be largely overestimated, due to the additional percentage scaling. This will lead to the excess pot for participants being much lower and hence failing to incentivize participation in the long run.

Proof of Concept

The Lottery calculates the new expected profit via LotteryMath.calculateNewProfit:

uint256 expectedRewardsOut = jackpotWon
    ? calculateReward(oldProfit, fixedJackpotSize, fixedJackpotSize, ticketsSold, true, expectedPayout)
    : calculateMultiplier(calculateExcessPot(oldProfit, fixedJackpotSize), ticketsSold, expectedPayout)
        * ticketsSold * expectedPayout;

The issue is that in the no-jackpot-case the value for expectedRewardsOut will be scaled by an additional PERCENTAGE_BASE precision (thats what calculateMultiplier returns). The value is meant to express an amount of rewardTokens though. Hence the value is too large by a factor of 1e5 and will cause the problem mentioned under #Impact.

Tools Used

Manual Review

Recommended Mitigation Steps

Perform normalization via getPercentage.