# Rounding error in Aave Lending Pool Low/Info · Sherlock · AI compute financing · 28th March, 2025 Finding L-3 of the GAIB Pre-Vaults security review. - Protocol: https://gaib.ai/ - Report: /reports/gaib - Source: https://4221781861-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FLXNTW9blcTeiKZrMFhab%2Fuploads%2FQMsETA4dRNo2auiUSeOX%2FAIDa%20Vault%20Audit_20250411.pdf?alt=media&token=5e2f84ea-9698-4fa7-81ef-503771d234aa --- ## Summary The aave lending pool produces rounding errors when calling `PreDepositVault::earn()`. ## Vulnerability Detail These errors were found to be negligible, being at most 1 wei, and they can either increase or decrease `totalAssets()` by 1. It shouldn't be exploitable but it's good to know. ## Impact `totalPrincipal` will be under/overestimated by 1 wei. For example, earning 1000 in `PreDepositVault::earn()`: 1. If it rounds up, `totalPrincipal` is 1000 but there will already be 1 profit, as we get 1001 aTokens 2. If it rounds down, `totalPrincipal` is 1000 but we only have 999 aTokens. Due to decimals in the assets, this isn't impactful. 1 wei is at most `1e-8` wbtc. ## Code Snippet https://github.com/sherlock-audit/2025-03-gaib/blob/main/pre-vaults/contracts/pre-vaults/gpdWBTC.sol#L56-L62 ## Tool Used Manual Review ## Recommendation Rounding error is very small so no fix is needed. --- Related findings: - [In GLendingPool, event parameters can be indexed](https://0xsimao.com/findings/glacier-lending-event-parameters-indexed): Glacier - [In GLendingPool, remove incorrect comment](https://0xsimao.com/findings/glacier-lending-remove-incorrect-comment): Glacier - [Decimals of LendingPool don't take into account the offset introduced by VIRTUAL_SHARES](https://0xsimao.com/findings/init-capital-ii-decimals-introduced-virtual-shares): INIT Capital - [Aave rounding behavior allows malicious users to drain accumulated yield via small withdrawals](https://0xsimao.com/findings/superfluid-aave-rounding-drain-yield): Superfluid Yield Backends