calculateUsableTick calculation is not done properly .

[c4-bot-5]

Lines of code

https://github.com/code-423n4/2024-05-predy/blob/e96f378007e3dc56b184079f0c0e4fe48a72efaa/src/libraries/Reallocation.sol#L109

Vulnerability details

When calculating the calculateUsableTick is should be considered the fractional part and if fractional part is less than 0.5, it rounds to the lower integer; when it’s greater than 0.5 it rounds to the greater integer; and when it’s 0.5, it rounds to the greater integer as well. But this calculateUsableTick calculation its not consider this & round down to the lower integer always.

Proof of Concept

calculateUsableTick

    function calculateUsableTick(int24 _tick, int24 tickSpacing) internal pure returns (int24 result) {
        require(tickSpacing > 0);

        result = _tick;

        if (result < TickMath.MIN_TICK) {
            result = TickMath.MIN_TICK;
        } else if (result > TickMath.MAX_TICK) {
            result = TickMath.MAX_TICK;
        }

        result = (result / tickSpacing) * tickSpacing;
    }

From Uniswap V3 docs

Where Math.round is rounding to the nearest integer: when the fractional part is less than 0.5, it rounds to the lower integer; when it’s greater than 0.5 it rounds to the greater integer; and when it’s 0.5, it rounds to the greater integer as well.

Impact

Incorrect calculation of nearest usable tick

Tools Used

Manual Review

Recommended Mitigation Steps

Use these 2 functions for calculateUsableTick. (As Uniswap V3 docs)

function nearestUsableTick(int24 tick_, uint24 tickSpacing)
    internal
    pure
    returns (int24 result)
{
    result =
        int24(divRound(int128(tick_), int128(int24(tickSpacing)))) *
        int24(tickSpacing);

    if (result < TickMath.MIN_TICK) {
        result += int24(tickSpacing);
    } else if (result > TickMath.MAX_TICK) {
        result -= int24(tickSpacing);
    }
}

function divRound(int128 x, int128 y)
    internal
    pure
    returns (int128 result)
{
    int128 quot = ABDKMath64x64.div(x, y);
    result = quot >> 64;

    // Check if remainder is greater than 0.5
    if (quot % 2**64 >= 0x8000000000000000) {
        result += 1;
    }
}

Assessed type

Uniswap

[Yasashari]

Hello @alex-ppg , Please check the provided uniswap v3 docs in the report. Please let me know any feed back here ?
Thank You.

[alex-ppg]

Hey @Yasashari, thanks for contributing to the PJQA process! This represents a validation repository finding and as such was not evaluated by me directly.

This submission appears to be a duplicate of a QA-level submission as described here: code-423n4/2024-05-predy-findings#295