@rdin777
Headline: Just "broke" my Starknet staking contract to learn a lesson. 💀
I’ve been deep-diving into Cairo math lately. Found (and proved) a classic Rounding Error vulnerability.
The Bug: Division before Multiplication.
In integer math, (a / b) * c is NOT the same as (a * c) / b.
If total_supply is huge, rewards literally become zero. Every. Single. Time.
The Fix: Always multiply before you divide to keep that precision alive. 📈
Wrote a full deep dive on DEV.to and pushed the PoC to GitHub.
Check it out:
https://dev.to/rdin777/how-i-broke-my-starknet-staking-contract-with-simple-math-a-lesson-on-rounding-errors-50ob
CC: @starknet @starknet-foundry
#starknet #cairo #security #build
0 reply
0 recast
1 reaction