F-2024-0002·incorrect-arithmetic

Incorrect Confidence Calculation in Ticket Minting

Acknowledgeddexammraffle
TL;DR

calculateTicketsToMint reads _pythPrice.price instead of _pythPrice.conf for the confidence value, so (price - confidence) yields zero or negative ticket amounts and every purchase reverts.

Severity
CRITICAL
Impact
HIGH
Likelihood
HIGH
Method
MManual review
CAT.
Complexity
LOW
Exploitability
HIGH
02Section · Description

Description

In the calculateTicketsToMint function of the MonadexV1Library contract, there is a critical error in the calculation of the confidence value. The function is using _pythPrice.price instead of _pythPrice.conf for the confidence calculation. This mistake leads to an incorrect subtraction of the confidence from the price, resulting in zero or negative ticket amounts.

Incorrect code:

solidity
uint256 confidence = _pythPrice.expo < 0
? uint256(uint64(_pythPrice.price)) * decimals / 10 ** uint256(uint32(-1 * _pythPrice.expo))
: uint256(uint64(_pythPrice.price)) * decimals * 10 ** uint256(uint32(-1 * _pythPrice.expo));

The current implementation:

solidity
uint256 ticketsToMint = (price - confidence) * _amount / _pricePerTicket;
03Section · Impact

Impact

The function will always calculate zero or negative tickets to mint, causing all ticket purchase transactions to revert with MonadexV1Raffle__ZeroTickets error. The raffle system becomes non-functional as no user can purchase tickets.

04Section · Recommendation

Recommendation

Correct code should use _pythPrice.conf:

solidity
uint256 confidence = _pythPrice.expo < 0
? uint256(uint64(_pythPrice.conf)) * decimals / 10 ** uint256(uint32(-1 * _pythPrice.expo))
: uint256(uint64(_pythPrice.conf)) * decimals * 10 ** uint256(uint32(-1 * _pythPrice.expo));
F-2024-0002

oog
zealynx

Smart Contract Security Digest

Monthly exploit breakdowns, audit checklists, and DeFi security research — straight to your inbox

© 2026 Zealynx