Submitted by SpicyMeatball, also found by 0xRobocop, 0xAlix2, samuraii77, DanielArmstrong, Rhaydden, ubl4nk, alix40, 0xStalin, asui, zanderbyte, carlos__alegre, Honour, lanrebayode77, Infect3d, elhaj, Nihavent, Bigsam, trachev, 0xRstStn, Jorgect, hyh, serial-coder, KupiaSec, shaflow2, pkqs90, Sentryx, said, and zzebra83
https://github.com/code-423n4/2024-06-size/blob/main/src/libraries/actions/Compensate.sol#L119-L125https://github.com/code-423n4/2024-06-size/blob/main/src/libraries/actions/Compensate.sol#L136
User can split his debt credit using the compensate function without paying the fragmentation fee.
The fragmentation fee normally applies when the initial credit amount is split, creating a new credit position with the fractionalized amount. However, under specific conditions when the compensate function is invoked, this fee is not charged.
Consider the following scenario, the user compensates half of his debt (amountToCompensate = creditPositionWithDebtToRepay.credit / 2) with a new credit position (params.creditPositionToCompensateId == RESERVED_ID) to the lender:
In the above code snippet, a new credit position is created with credit = futureValue = amountToCompensate. This results in creditPositionToCompensate.credit always equating to amountToCompensate, leading exiterCreditRemaining to consistently be zero:
As a result, despite splitting creditPositionWithDebtToRepay.credit in half and creating a new credit position, the fragmentation fee is not deducted as expected.
aviggiano (Size) confirmed and commented:
For this audit, 11 reports were submitted by wardens detailing low risk and non-critical issues. The report highlighted below by ether_sky received the top score from the judge.
The following wardens also submitted reports: 0xhacksmithh, alix40, K42, Bauchibred, 0xRobocop, Rhaydden, atoko, Shield, NexusAudits, and pkqs90.
