First Flight #3: Thunder Loan
First Flight #3
Beginner FriendlyFoundryDeFiOracle
100 EXP
View results
Previous Next
Submission Details
Severity: medium
Invalid

Different token have different value of `decimals` so `EXCHANGE_RATE_PRECISION` in AssertToken.sol should not be a constant

naman1729

Summary

  • EXCHANGE_RATE_PRECISION in AssertToken.sol should not be a constant because different token have different value of decimals so it can create a wrong calculation in deposit function in ThunderLoan.sol and mintAmount in deposit function give wrong value.

Vulnerability Details

Click this to see Code `ThunderLoan.sol: :deposit`
function deposit(IERC20 token, uint256 amount) external revertIfZero(amount) revertIfNotAllowedToken(token) {
AssetToken assetToken = s_tokenToAssetToken[token];
uint256 exchangeRate = assetToken.getExchangeRate();
@> uint256 mintAmount = (amount * assetToken.EXCHANGE_RATE_PRECISION()) / exchangeRate;
emit Deposit(msg.sender, token, amount);
assetToken.mint(msg.sender, mintAmount);
uint256 calculatedFee = getCalculatedFee(token, amount);
assetToken.updateExchangeRate(calculatedFee);
token.safeTransferFrom(msg.sender, address(assetToken), amount);
}

  • EXCHANGE_RATE_PRECISION in AssertToken.sol should not be a constant because different token have different value of decimals so it can create a wrong calculation in deposit function in ThunderLoan.sol and mintAmount in deposit function give wrong value.

Click this to see Code `AssertToken.sol: :EXCHANGE_RATE_PRECISION`
uint256 private s_exchangeRate;
@> uint256 public constant EXCHANGE_RATE_PRECISION = 1e18;
uint256 private constant STARTING_EXCHANGE_RATE = 1e18;

  • above code is showing that EXCHANGE_RATE_PRECISION is a constant and it is not a good practice because different token have different value of decimals.

for example:

/**
* - USDT: 0xdAC17F958D2ee523a2206206994597C13D831ec7 // 6 decimals
* - USDC: 0xA0b86991c6218b36c1d19D4a2e9Eb0cE3606eB48 // 6 decimals
* - STA: 0xa7DE087329BFcda5639247F96140f9DAbe3DeED1 // 18 decimals
* - PAXG: 0x45804880De22913dAFE09f4980848ECE6EcbAf78 // 18 decimals
* - BNB: 0xB8c77482e45F1F44dE1745F52C74426C631bDD52 // 18 decimals
* - ZIL: 0x05f4a42e251f2d52b8ed15E9FEdAacFcEF1FAD27 // 12 decimals
* - KNC: 0xdd974D5C2e2928deA5F71b9825b8b646686BD200 // 18 decimals
*/

Impact

  • mintAmount in deposit function give wrong value.

Tools Used

  • Manual review

Recommendations

uint256 private s_exchangeRate;
- uint256 public constant EXCHANGE_RATE_PRECISION = 1e18;
+ uint256 public EXCHANGE_RATE_PRECISION = decimals();

  • This can give a correct value of decimals.

Updates

Lead Judging Commences

0xnevi Lead Judge
over 1 year ago
0xnevi Lead Judge over 1 year ago
Submission Judgement Published
Invalidated
Reason: Other

Support

FAQs

Can't find an answer? Chat with us on Discord, Twitter or Linkedin.