# Division rounding can make fraction-price lower than intended (down to zero)

Integer division truncation in Fractional Buyout makes fractionPrice round to zero or half, letting buyers acquire fractions free and mispricing buyout payouts.

- Payout: Contest reward
- Severity: high
- Program: Fractional
- Credited: 0xA5DF
- Disclosed: 2022-09-27
- Write-up quality: 7/10
- Original: https://github.com/code-423n4/2022-07-fractional-findings/issues/310
- Library page: https://bugbountylibrary.com/r/c4%3A2022-07-fractional%3AH-04
- Tags: domain:web3 impact:funds-loss kind:contest platform:code4rena sev:high tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:precision-loss

**Target:** Buyout.sol buyout module (start/sellFractions/buyFractions)
**Root cause:** fractionPrice = buyoutPrice / totalSupply truncates; when buyoutPrice is near or below totalSupply the per-fraction price rounds to 0 or loses up to ~50%, and sell/buy math uses this truncated value.
**Steps:**
1. Deploy Buyout with vault totalSupply=21e17, Bob holds half.
2. Bob calls `start{value:1 ether}(vault)`; fractionPrice = buyoutPrice/totalSupply truncates to 0.
3. Eve calls `buyFractions{value:0}(vault, BOB_INITIAL_BALANCE)` and receives all fractions for 0 ETH.
4. Variant: totalSupply=11e17, buyoutPrice=2 ether => fractionPrice=1; Alice sells 9/10 supply for ~0.99 ETH while Bob keeps ~1.01 ETH.
5. After 4.1 days call `end` and `cash` to observe mispriced payouts.
**How found:** Researcher reasoned about EVM integer division truncation and noticed fractionPrice is derived by dividing buyoutPrice by totalSupply, then tested edge cases where the quotient is 0 or 1 with Foundry.
**Exploitation:** Attacker waits for a buyout where buyoutPrice/totalSupply truncates to 0 (or low), then buys all fractions for zero/near-zero ETH, acquiring the vault's fractions cheaply; alternatively proposer loses fractions or cashout differential is captured by late cashers.
**Insight:** When a per-unit price is derived by dividing a total by supply, test values where the quotient is 0 or 1; truncation there can zero out or halve the price and let buyers acquire units for free.