# Vault can lose rewards due to lack of precision

Derby Vault's storePriceAndRewards divides reward numerator by denominator without scaling, so integer truncation zeroes out performance rewards for low-decimal tokens like USDC.

- Payout: Contest reward
- Severity: high
- Program: Derby
- Credited: cergyk
- Disclosed: 2022-10-17
- Write-up quality: 7/10
- Original: https://github.com/sherlock-audit/2023-01-derby-judging/issues/238
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-01-derby%3AH-8
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity vuln:accounting-error vuln:precision-loss vuln:reward-distribution

**Target:** Vault.sol storePriceAndRewards reward accounting
**Root cause:** rewardPerLockedToken = nominator/denominator where nominator = _totalUnderlying*performanceFee*priceDiff and denominator = totalAllocatedTokensRounded*lastPrice*100; no scaling factor, so small priceDiff relative to price truncates to zero.
**Steps:**
1. Set up Idle USDC vault: TotalUnderlying=30k USDC (1e6 decimals), performanceFee=5, totalAllocatedTokens=1e6*1e18, lastPrices=1_100_000 (1.1 USDC).
2. Assume 1.7% APY => bi-weekly priceDiff ≈ 730.
3. Call storePriceAndRewards: nominator = 30000*1e6*5*730, denominator = 1e6*1_100_000*100.
4. Observe nominator/denominator = 0 => rewardPerLockedToken = 0 every period.
**How found:** Code reading of storePriceAndRewards formula; noticed integer division with no scaling and tested with realistic USDC numbers showing truncation to zero.
**Exploitation:** No attacker action; protocol silently accrues zero rewards for stakers in low-decimal-price protocols, so rewards are lost rather than stolen.
**Escalation:** Escalation argued precision loss applies to all protocols since priceDiff and lastPrice share precision, raising severity from medium to high.
**Insight:** When a reward/yield formula divides a small delta (priceDiff) by a large base (lastPrice) in integer math, check whether the numerator needs a scaling factor (e.g. 1e18) to avoid truncation to zero for low-decimal or low-volatility assets.