Submitted by unforgiven, also found by xiaoming90
BridgeFacet.sol#L753-L803
BridgeFacet.sol#L526-L616
Variable routerBalances suppose to keep track of routers balance in contract and routers can withdraw their balance from contract. but because of division rounding error in _handleExecuteLiquidity() and _reconcile() contract uses more of its tokens than it subtract from routers balance. this can lead to fund lose.
This is _handleExecuteLiquidity() code:
As you can see in last part it uses uint256 routerAmount = toSwap / pathLen  to calculate amount to decrease from routers balance but because of division rounding error contract using toSwap amount of token buy total value it decrease from routers balances are lower than toSwap.
Of course in _reconcile() contract add some amount to routers balances again with division rounding error, but because the amounts are different in this two functions (in _handleExecuteLiquidity() we subtract fee and in _reconcile() we dont subtract fee) so the division rounding error would be different for them and in the end sum of total balances of routers would not be equal to contract balance. this bug could be more serious for tokens with low precision and higher price.
VIM
Perform better calculations.
LayneHaber (Connext) acknowledged, but disagreed with severity and commented:
0xleastwood (judge) decreased severity to QA and commented:
0xleastwood (judge) increased severity to Medium and commented:
