Foundry DeFi Stablecoin CodeHawks Audit Contest
Cyfrin
DeFiFoundry
15,000 USDC
View results
Previous Next
Submission Details
Severity: high
Valid

ERC20 token that is not 18 decimals is not supported

SBSecurity

Summary

Protocol is hard coded to ERC20 tokens with 18 decimals, which leads to wrong calculations and can produce a loss of funds when using tokens with differences in decimals.

Vulnerability Details

For example, USDC has only 6 decimals, and if mix it with other tokens that have more decimals (ex: 18, 24), it will return the wrong calculation and always will assume the token with the large amount of decimals for the calculations which will break the precision and a lot of the functionality.

// @audit test with more that one token collateral deposited, when deposited tokens have different decimals
function testIfHealthFactorIsWith18Decimals() public {
vm.startPrank(user);
ERC20Mock(weth).mint(user, 10e24);
ERC20Mock(weth).approve(address(dsce), amountCollateral);
dsce.depositCollateralAndMintDsc(weth, amountCollateral, amountToMint);
​
ERC20Mock(wbtc).approve(address(dsce), 10e10);
dsce.depositCollateral(wbtc, 10e10);
vm.stopPrank();
​
int256 ethUsdUpdatedPrice = 18e8; // 1 ETH = $18
// 180000000000000180000000000 - Total Collateral in USD
// 900,000,000,000,000,900,000,000 Health factor for
// WETH with 24 decimals 100 deposited and WBTC with 10 decimals 100 deposited and 100 DSC minted
​
​
MockV3Aggregator(ethUsdPriceFeed).updateAnswer(ethUsdUpdatedPrice);
​
uint256 userHealthFactor = dsce.getHealthFactor(user);
​
assert(userHealthFactor < 1e18);
}

https://prnt.sc/elsi2gbyWqH9

Instances

https://github.com/Cyfrin/2023-07-foundry-defi-stablecoin/blob/main/src/DSCEngine.sol#L324-L332
https://github.com/Cyfrin/2023-07-foundry-defi-stablecoin/blob/main/src/DSCEngine.sol#L340-L348
https://github.com/Cyfrin/2023-07-foundry-defi-stablecoin/blob/main/src/DSCEngine.sol#L71-L71

Impact

High, the whole protocol precision calculations are hardcoded to 18 decimals.

Tools Used

Manual Review

Recommendations

Add support for ERC20 tokens with different decimals that 18 by checking decimals() when make calculations. If protocol is only for ERC20 tokens with 18 decimals, checks should be added in the constructor.

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.