Divide-before-multiply pattern
A code & audits factor in the v1.7.0 rubric. Measured per protocol on a s cadence.
Methodology how we score #
**What this measures** This factor runs the Slither divide-before-multiply detector on the protocol's deployed verified source code and records whether the detector fires on any function handling token amounts, exchange rates, or share calculations. The divide-before-multiply pattern -- where a division is performed before a multiplication that depends on the intermediate result -- causes precision loss that can be exploited to extract value by rounding the attacker's favor repeatedly.
**Why it matters** Integer arithmetic in Solidity is fixed-point with no fractional representation. Dividing before multiplying causes the intermediate result to lose precision, and when this precision loss is consistent (e.g., always rounding down for the user, never for the protocol), an attacker can repeatedly exploit the rounding to extract small amounts per transaction at scale. The pattern appears in approximately seven documented hacks in the T-01 evidence inventory. It is particularly dangerous in exchange rate calculations where shares-to-assets conversions are called millions of times by users.
**Green / Yellow / Red** Green: the Slither divide-before-multiply detector reports no findings on the deployed verified source, or all findings are in non-financial computation paths confirmed by curator review. Yellow: findings exist in peripheral calculation paths (e.g., fee calculations with small absolute impact) but not in core exchange rate or collateral accounting functions. Red: the detector fires on a core exchange rate, share price, or collateral accounting function that directly affects user fund calculations.
**Common gray cases** This factor cannot be graded when the protocol's source is not verified on any explorer. It is gray for protocols written in Vyper or Yul where the Slither Solidity detector does not apply reliably.
Measurement what to look for #
Determine whether Slither's `divide-before-multiply` detector fires on the deployed verified source.