Divide-before-multiply pattern
Save (formerly Solend)'s assessment for RD-F-016 — scored green on the v1.7.0 rubric. The evidence below is the curator's reasoning for this score.
Evidence summary #
The Dec 2021 Neodyme vulnerability was precisely a rounding-direction error (divide-before-multiply class). Solend patched this on Dec 2, 2021 within the coordinated disclosure window, replacing rounding-up with floor operations. Current deployed code has the fix applied. No subsequent rounding-error finding identified.
Sources #
- URLBug in Solana Token Lending Contract FixedNeodyme SPL rounding-error patch applied by Solend Dec 2 2021retrieved 2026-05-17
Methodology #
Determine whether Slither's `divide-before-multiply` detector fires on the deployed verified source.
See the full factor methodology and distribution across all protocols →
rubric_version v1.7.0 protocol save factor RD-F-016 score green collected_at 2026-05-17 15:20:15