# Error in OstiumPairsStorage::groupMaxCollateral() calculation Medium · Three Sigma · RWA perpetuals DEX · 19th February, 2024 Finding 3S-OS-M06 of the Ostium security review. - Protocol: https://www.ostium.com/ - Report: /reports/ostium - Source: https://cdn.sanity.io/files/qoqld077/production/a95b9c69e0f65d1d6b0e649f0d62a362358ca8ce.pdf --- ### Description The [calculation](https://github.com/0xOstium/smart-contracts-threeSigma/blob/1b70cffbac621d39e321c159e45c048b703add92/src/OstiumPairsStorage.sol#L234) of the maximum deposited collateral per group, erroneously divides by 100, assuming it refers to 100%. However, the maxCollateralP variable, specified [here](https://github.com/0xOstium/smart-contracts-threeSigma/blob/1b70cffbac621d39e321c159e45c048b703add92/src/interfaces/IOstiumPairsStorage.sol#L21), has a precision of 2 decimals. This means that 100% is expressed as 100_00. This discrepancy results in [incorrect checks](https://github.com/0xOstium/smart-contracts-threeSigma/blob/1b70cffbac621d39e321c159e45c048b703add92/src/OstiumTradingCallbacks.sol#L513) in OstiumTradingCallbacks::withinExposureLimits(), potentially causing the vault's collateral to be capped at a much larger amount than intended. Furthermore, this miscalculation may dilute the reported profits. ### Recommendation To avoid errors related to magic numbers, utilize constants for precision. Additionally, if using 100_00 to denote 100% consistently, it's preferable to adhere to Basis Point (BPS) denomination. ### Status Addressed in [#733206c](https://github.com/0xOstium/smart-contracts-threeSigma/pull/58/commits/733206c98d5ac8e48875c3087bcab0a6c0c2c9d7). --- Related findings: - [Base calculation in `Leverager::isLiquidateable()` is incorrect as the max leverage may be smaller](https://0xsimao.com/findings/yieldoor-leverager-liquidateable-leverage-smaller): Yieldoor - [Drained lender due to `LenderCommitmentGroup_Smart::acceptFundsForAcceptBid()` `_collateralAmount` by `STANDARD_EXPANSION_FACTOR` multiplication](https://0xsimao.com/findings/teller-finance-bid-collateral-factor-multiplication): Teller Finance - [`FlashRolloverLoan_G5` will fail for `LenderCommitmentGroup_Smart` due to `CollateralManager` pulling collateral from `FlashRolloverLoan_G5`](https://0xsimao.com/findings/teller-finance-flash-rollover-collateral-pulling): Teller Finance - [A sufficiently large collateral may break the maximum owed M calculation](https://0xsimao.com/findings/m-0-sufficiently-collateral-maximum-owed): M^0 Minter Gateway