Merge pull request from GHSA-p4j4-4h8c-rrc6

fix: rounding error in L2 Curation

Author: pcarranzav

packages/contracts/contracts/curation/Curation.sol

@@ -340,6 +340,8 @@ contract Curation is CurationV2Storage, GraphUpgradeable {
         override
         returns (uint256, uint256)
     {
+        // NOTE: We're aware that this function rounds down and tax can be 0 for small amounts
+        // of tokens but since minimumCurationDeposit is 1 GRT tax will always be greater than 0.
         uint256 curationTax = _tokensIn.mul(uint256(curationTaxPercentage)).div(MAX_PPM);
         uint256 signalOut = _tokensToSignal(_subgraphDeploymentID, _tokensIn.sub(curationTax));
         return (signalOut, curationTax);

packages/contracts/contracts/l2/curation/L2Curation.sol

@@ -400,8 +400,14 @@ contract L2Curation is CurationV2Storage, GraphUpgradeable, IL2Curation {
         override
         returns (uint256, uint256)
     {
-        uint256 curationTax = _tokensIn.mul(uint256(curationTaxPercentage)).div(MAX_PPM);
-        uint256 signalOut = _tokensToSignal(_subgraphDeploymentID, _tokensIn.sub(curationTax));
+        // Calculate tokens after tax first, subtract that from the tokens in
+        // to get the curation tax to avoid rounding down to zero.
+        uint256 tokensAfterCurationTax = uint256(MAX_PPM)
+            .sub(curationTaxPercentage)
+            .mul(_tokensIn)
+            .div(MAX_PPM);
+        uint256 curationTax = _tokensIn.sub(tokensAfterCurationTax);
+        uint256 signalOut = _tokensToSignal(_subgraphDeploymentID, tokensAfterCurationTax);
         return (signalOut, curationTax);
     }
 

packages/contracts/test/unit/l2/l2Curation.test.ts

@@ -469,6 +469,47 @@ describe('L2Curation', () => {
         .mint(subgraphDeploymentID, tokensToDeposit, expectedSignal.add(1))
       await expect(tx).revertedWith('Slippage protection')
     })
+
+    it('should pay a minimum of 1 wei GRT in tax when depositing small amounts', async function () {
+      // Set minimum curation deposit
+      await contracts.Curation.connect(governor).setMinimumCurationDeposit('1')
+
+      // Set curation tax to 1%
+      await contracts.Curation.connect(governor).setCurationTaxPercentage(10000)
+
+      // Deposit a small amount where tax would be less than 1 wei
+      const tokensToDeposit = '99'
+
+      const expectedTokens = '98'
+      const expectedSignal = '98'
+      const expectedTax = 1
+
+      const tx = contracts.Curation.connect(curator).mint(
+        subgraphDeploymentID,
+        tokensToDeposit,
+        expectedSignal,
+      )
+
+      await expect(tx)
+        .emit(contracts.Curation, 'Signalled')
+        .withArgs(
+          curator.address,
+          subgraphDeploymentID,
+          tokensToDeposit,
+          expectedSignal,
+          expectedTax,
+        )
+
+      const burnTx = contracts.Curation.connect(curator).burn(
+        subgraphDeploymentID,
+        expectedSignal,
+        expectedTokens,
+      )
+
+      await expect(burnTx)
+        .emit(contracts.Curation, 'Burned')
+        .withArgs(curator.address, subgraphDeploymentID, expectedTokens, expectedSignal)
+    })
   })
 
   describe('curate tax free (from GNS)', async function () {