Moonwell // SCA (Reserve + ERC20HoldingDeposit)

In the ReserveAutomation contract, the discount (or premium) is computed in the function currentDiscount(), as follows:

    /// @notice Calculates the current discount or premium rate for reserve purchases
    /// @return The current discount as a percentage scaled to 1e18, returns
    /// 1e18 if no discount is applied
    /// @dev Does not apply discount or premium if the sale is not active
    function currentDiscount() public view returns (uint256) {
        if (!isSaleActive()) {
            return SCALAR;
        }

        uint256 decayDelta = startingPremium - maxDiscount;
        uint256 periodStart = getCurrentPeriodStartTime();
        uint256 periodEnd = getCurrentPeriodEndTime();
        uint256 saleTimeRemaining = periodEnd - block.timestamp;

        /// calculate the current premium or discount at the current time based
        /// on the length you are into the current period
        return
            maxDiscount +
            (decayDelta * saleTimeRemaining) /
            (periodEnd - periodStart);
    }

The value for periodStart is obtained from the return of the getCurrentPeriodEndTime() function, defined as follows:

    /// @notice Returns the end time of the current mini auction period
    /// @return The timestamp when the current mini auction period ends
    /// @dev Returns 0 if no sale is active or if the sale hasn't started yet
    /// @dev Each period is exactly miniAuctionPeriod in length
    function getCurrentPeriodEndTime() public view returns (uint256) {
        uint256 startTime = getCurrentPeriodStartTime();
        if (startTime == 0) {
            return 0;
        }

        return startTime + miniAuctionPeriod - 1;
    }

In other words, the denominator becomes periodEnd - periodStart = miniAuctionPeriod - 1. If the miniAuctionPeriod is set to 1 - which is possible, because the condition in the require statement of the initiateSale() function is as follows: _auctionPeriod / _miniAuctionPeriod > 1.

In extremely rare conditions, where _miniAuctionPeriod is 1 and _auctionPeriod is 2, then the denominator is zero and the contract will revert with a division-by-zero error.

It is recommended to add an explicit check in the initiateSale() function to ensure that _miniAuctionPeriod > 1. For example:

require(_miniAuctionPeriod > 1, "ReserveAutomation: Mini auction period too short");

Alternatively, update the NatSpec documentation to provide proper information regarding the mini auction period.

ACKNOWLEDGED: The Moonwell team has acknowledged this issue.