# FundingRateArbitrage contract can be drained due to rounding error

Rounding down of lockedEarnUSDCAmount in FundingRateArbitrage.requestWithdraw lets an attacker repay 1 JUSD and withdraw a full earnUSDC share, draining JUSD.

- Payout: Contest reward
- Severity: high
- Program: Jojo Exchange Update
- Credited: detectiveking
- Disclosed: 2023-12-14
- Write-up quality: 8/10
- Original: https://github.com/sherlock-audit/2023-12-jojo-exchange-update-judging/issues/57
- Library page: https://bugbountylibrary.com/r/sherlock%3A2023-12-jojo-exchange-update%3AH-2
- Tags: domain:web3 impact:funds-loss kind:contest platform:sherlock sev:high tech:evm tech:solidity technique:chained technique:source-review vuln:accounting-error vuln:share-inflation

**Target:** FundingRateArbitrage.sol requestWithdraw / permitWithdrawRequests
**Root cause:** lockedEarnUSDCAmount = jusdOutside[msg.sender].decimalDiv(index) rounds down, so withdrawEarnUSDCAmount = earnUSDCBalance - lockedEarnUSDCAmount is inflated; repaying a tiny JUSD amount unlocks a full earnUSDC share.
**Steps:**
1. Attacker deposits 1 USDC then transfers 100e6-1 USDC directly to contract, setting share price ~$100 with 1 earnUSDC share.
2. Second EOA deposits ~101 USDC to mint 1 earnUSDC and receive ~100 JUSD.
3. Call `requestWithdraw(1)` from second EOA: jusdOutside becomes 0, lockedEarnUSDCAmount rounds to 0, withdrawEarnUSDCAmount = 1.
4. Owner calls `permitWithdrawRequests([id])`; attacker withdraws the full ~$100 earnUSDC share having repaid only 1 JUSD.
5. Repeat steps 2-4 to drain all JUSD in contract.
**How found:** Code review of requestWithdraw spotted decimalDiv rounding down before subtracting from earnUSDCBalance, making withdrawEarnUSDCAmount larger than justified; constructed donation-based share-price scenario to weaponize it.
**Exploitation:** Attacker seeds share price via direct USDC donation, mints a single share from a second EOA, then repays 1 JUSD to unlock the entire share through the rounding-down bug; permitWithdrawRequests releases the earnUSDC, netting profit minus fees.
**Escalation:** Chains with first-depositor share inflation to make share price nontrivial; looped to drain all JUSD.
**Insight:** In share/asset accounting, check every division's rounding direction against who benefits; a round-down on a 'locked' amount inflates the withdrawable remainder, and pairing it with a donation-inflated share price turns a 1-wei repayment into a full-share withdrawal.