Submission Details
Severity:
Lender logic is based only for ERC20 tokens with 18 decimals
Summary
The Lender.sol contract is hardcoded to work only with 18 decimals ERC20 tokens.
Vulnerability Details
In the current implementation loanRation in borrow(), giveLoan(), and refinance() functions are hardcoded to 18 decimals calculations.
src\Lender.sol
591: function refinance(Refinance[] calldata refinances) public {
for (uint256 i = 0; i < refinances.length; i++) {
...
...
// If the debt is with 10 decimals and collateral is with 24
// 50e10 debt - 120e24 collateral = the loanRation will be 41,666 no decimals and the whole calculation will be a total mess
if (pool.poolBalance < debt) revert LoanTooLarge();
if (debt < pool.minLoanSize) revert LoanTooSmall();
uint256 loanRatio = (debt * 10 ** 18) / collateral;
if (loanRatio > pool.maxLoanRatio) revert RatioTooHigh();
...
...
}
}
Impact
Loss of precision, mixing tokens with different decimals can lead to loss of funds.
Tools Used
Manual
Recommendations
Consider restricting what tokens can be used if want to leave these calculations, or use ERC20.decimals() to prevent precision loss.
Prize pool breakdown
Total prize
20,000 USDC
nSLOC
70628 USDC / LOC
18,000 USDC
2,000 USDC
Live
The contest is live. Earn rewards by submitting a finding.
Appeals
This is your time to appeal against judgements on your submissions.
Appeals Review
Appeals are being carefully reviewed by our judges.