Steadefi
Steadefi
DeFiHardhatFoundryOracle
35,000 USDC
View results
Previous Next
Submission Details
Severity: low
Valid

Broken `convertToUsdValue` calculation on tokens that have more than 18 decimal places

tychaios

Vulnerability Details

In GMXReader.sol:67, the function convertToUsdValue is designed to calculate the market value of a given amount of tokens. However, the function assumes that all tokens operate with 18 or fewer decimal places. The code uses a fixed subtraction method (18 - IERC20Metadata(token).decimals()) that will revert if a token has more than 18 decimal places, thus breaking the calculation.

Impact

The impact of this vulnerability is low in terms of probability due to the rarity of tokens with more than 18 decimals, but if such a token were used, it would render the calculation and consequently the function inoperable.

Tools Used

Manual Review

Recommendations

To safely normalize the amt to 18 decimal places, the calculation should be adjusted as follows:

return (amt * self.chainlinkOracle.consultIn18Decimals(token)) / (10 ** IERC20Metadata(token).decimals());
Updates

Lead Judging Commences

hans Auditor
almost 2 years ago
hans Auditor
almost 2 years ago
hans Auditor
almost 2 years ago
hans Lead Judge almost 2 years ago
Submission Judgement Published
Validated
Assigned finding tags:

Tokens with more than 18 decimals are not supported

Underflow in convertToUsdValue

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.